Falhas do tipo CWE-79

30.284 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-24640HIGHWordPress Empty Tags Remover Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27338HIGHWordPress List Urls Plugin <= 0.2 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32564HIGHWordPress Stop Registration Spam Plugin <= 1.24 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-54221MEDIUMReflected XSS in UBB.threadsEPSS 0.3%CVE-2026-26023MEDIUMClient‑side DOM XSS in the web chat app of Dify when using echartsEPSS 0.3%CVE-2025-24637HIGHWordPress Beacon Lead Magnets and Lead Capture Plugin <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2440HIGHSurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-22565HIGHWordPress vooPlayer v4 Plugin <= 4.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27333HIGHWordPress Protected wp-login Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27295HIGHWordPress Live css plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32513HIGHWordPress Total processing card payments for WooCommerce plugin <= 7.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22692HIGHWordPress Sponsered Link plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-39464HIGHWordPress AdminQuickbar plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32615HIGHWordPress Clinked Client Portal Plugin <= 1.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32611HIGHWordPress WooCommerce TBC Credit Card Payment Gateway (Free) Plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-26746HIGHWordPress Advanced Custom Fields: Link Picker Field plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-32520HIGHWordPress WordPress Health and Server Condition plugin <= 4.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-67231MEDIUMA reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary code in the context EPSS 0.3%CVE-2025-25957MEDIUMCross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script.EPSS 0.3%CVE-2026-84477MEDIUMAVideo Stored XSS via Live Schedule Title DescriptionEPSS 0.3%