Falhas do tipo CWE-79

30.593 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-51662MEDIUMA stored cross-site scripting (XSS) vulnerability is found in the text sharing feature of FileCodeBox version 2.2 and earlier. Insufficient EPSS 0.2%CVE-2026-114194MEDIUMWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-10100MEDIUMSimple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-34897MEDIUMWordPress Media LIbrary Assistant plugin <= 3.34 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-42842MEDIUMgrav-plugin-form: XSS via Taxonomy Field Values in Admin PanelEPSS 0.2%CVE-2025-41106MEDIUMMultiple vulnerabilities in Fairsketch's RISE CRM FrameworkEPSS 0.2%CVE-2026-25341HIGHWordPress RSFirewall! plugin <= 1.1.45 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-49035MEDIUMWordPress Admin Menu Groups plugin <= 0.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-64289MEDIUMWordPress Premmerce Product Search for WooCommerce plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-32526HIGHWordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-59590MEDIUMWordPress Media Library Assistant Plugin <= 3.28 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-32494HIGHWordPress Image Slider by Ays plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-14888MEDIUMSimple User Meta Editor <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value FieldEPSS 0.2%CVE-2026-25376HIGHWordPress Addon Jobsearch Chat plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-14378MEDIUMQuick Testimonials <= 2.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-25342HIGHWordPress Boutique theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-23807HIGHWordPress WP Telegram Widget and Join Link plugin <= 2.2.13 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57891MEDIUMWordPress Recurring PayPal Donations Plugin <= 1.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-49039MEDIUMWordPress Link View plugin <= 0.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48968MEDIUMWordPress Master Slider plugin <= 3.10.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%