Falhas do tipo CWE-79

30.522 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2026-39336MEDIUMChurchCRM has Stored XSS from unescaped config values in HTML attributesEPSS 0.2%CVE-2025-58254MEDIUMWordPress StylePress for Elementor Plugin <= 1.2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53865MEDIUMIn Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).EPSS 0.2%CVE-2025-58253MEDIUMWordPress Real Estate Manager Plugin <= 7.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-10716MEDIUMPega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.EPSS 0.2%CVE-2026-89100MEDIUMPayment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL FragmentEPSS 0.2%CVE-2026-110899HIGHWordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-59565MEDIUMWordPress Upsell Order Bump Offer for WooCommerce Plugin <= 3.0.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58229MEDIUMWordPress Sitekit Plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58248MEDIUMWordPress Pinterest Pinboard Widget Plugin <= 1.0.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58031MEDIUMWordPress Nextend Facebook Connect Plugin <= 3.1.19 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-105220HIGHTwine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story FilesEPSS 0.2%CVE-2026-105124MEDIUMW (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and CommentsEPSS 0.2%CVE-2025-8726MEDIUMWP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_uploadEPSS 0.2%CVE-2025-58653MEDIUMWordPress JSM file_get_contents() Shortcode Plugin <= 2.7.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58654MEDIUMWordPress xili-language Plugin <= 2.21.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-36697MEDIUMA cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrarEPSS 0.2%CVE-2025-12872MEDIUMaEnrich｜eHRD - Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-62854HIGHFreeScout: Stored XSS in mailbox signature via same-origin JS uploadEPSS 0.2%CVE-2025-58026MEDIUMWordPress Termageddon: Cookie Consent & Privacy Compliance Plugin <= 1.8.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%