Falhas do tipo CWE-79

30.494 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-61995HIGHWordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48159HIGHWordPress Youtube Vimeo Video Player and Slider WP Plugin <= 3.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48098HIGHWordPress Survey Maker plugin <= 5.1.8.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54056HIGHWordPress Responsive HTML5 Audio Player PRO With Playlist <= 3.5.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-54855HIGHWordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60452MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download mEPSS 0.2%CVE-2026-11908MEDIUMTagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043EPSS 0.2%CVE-2025-23995HIGHWordPress Tantyyellow theme <= 1.0.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-96648MEDIUMData Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows ActionEPSS 0.2%CVE-2025-60448MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient valiEPSS 0.2%CVE-2025-26553HIGHWordPress Pre Order Addon for WooCommerce plugin<= 1.0.7 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2025-60781MEDIUMPHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) in the worksheet.php file via the participant_name parameter.EPSS 0.2%CVE-2025-24615HIGHWordPress Analytics Cat Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53324HIGHWordPress Gutenify Plugin <= 1.5.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-22262MEDIUMWordPress Bonjour Bar plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54680MEDIUMWordPress Blogger Buzz Theme theme <= 1.2.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-27379MEDIUMStored Cross-Site Scripting in AES BOM ViewerEPSS 0.2%CVE-2026-44899MEDIUMMistune Image Directive CSS Injection VulnerabilityEPSS 0.2%CVE-2025-22276MEDIUMWordPress Related Post Shortcode Plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-54298MEDIUMAstro: XSS via Unescaped Attribute Names in Spread PropsEPSS 0.2%