slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- High 7.2 Cross-Site Scripting (XSS) in LifePress (WordPress plugin) Cross-site scripting in LifePress (WordPress plugin) (CVE-2026-6690). Risk of unauthorized operations or information disclosure. Exploitable via wp_ajax_nopriv_lp_update_mds. CVE-2026-6690
- Medium 6.1 Cross-Site Scripting (XSS) in AzonPost (WordPress plugin) Cross-site scripting in AzonPost (WordPress plugin) (CVE-2026-7437). Risk of unauthorized operations or information disclosure. Exploitable via editpos_hidden. CVE-2026-7437
- Medium 6.1 Cross-Site Scripting (XSS) in Pricing Tables for WP (WordPress plugin) Cross-site scripting in Pricing Tables for WP (WordPress plugin) (CVE-2026-6808). Risk of unauthorized operations or information disclosure. CVE-2026-6808
- Medium 6.1 Cross-Site Scripting (XSS) in WP Google Maps Integration (WordPress plugin) Cross-site scripting in WP Google Maps Integration (WordPress plugin) (CVE-2026-7464). Risk of unauthorized operations or information disclosure. Exploitable via page. CVE-2026-7464
- Medium 6.4 Cross-Site Scripting (XSS) in Advanced Social Media Icons (WordPress plugin) Cross-site scripting in Advanced Social Media Icons (WordPress plugin) (CVE-2026-7659). Risk of unauthorized operations or information disclosure. Exploitable via social. CVE-2026-7659
- Medium 6.4 Cross-Site Scripting (XSS) in Shortcodely (WordPress plugin) Cross-site scripting in Shortcodely (WordPress plugin) (CVE-2026-6913). Risk of unauthorized operations or information disclosure. CVE-2026-6913
- Medium 6.4 Cross-Site Scripting (XSS) in SP Blog Designer (WordPress plugin) Cross-site scripting in SP Blog Designer (WordPress plugin) (CVE-2026-4859). Risk of unauthorized operations or information disclosure. Exploitable via wpsbd_post_carousel. CVE-2026-4859
- Medium 6.4 Cross-Site Scripting (XSS) in Next Date (WordPress plugin) Cross-site scripting in Next Date (WordPress plugin) (CVE-2026-4920). Risk of unauthorized operations or information disclosure. CVE-2026-4920
- Medium 6.4 Cross-Site Scripting (XSS) in Quick Table (WordPress plugin) Cross-site scripting in Quick Table (WordPress plugin) (CVE-2026-6237). Risk of unauthorized operations or information disclosure. CVE-2026-6237
- Medium 6.4 Cross-Site Scripting (XSS) in Fancy Image Show (WordPress plugin) Cross-site scripting in Fancy Image Show (WordPress plugin) (CVE-2026-5340). Risk of unauthorized operations or information disclosure. CVE-2026-5340
- Medium 6.4 Cross-Site Scripting (XSS) in Voyage Plus (WordPress plugin) Cross-site scripting in Voyage Plus (WordPress plugin) (CVE-2026-5715). Risk of unauthorized operations or information disclosure. CVE-2026-5715
- Medium 6.4 Cross-Site Scripting (XSS) in scratchblocks for WP (WordPress plugin) Cross-site scripting in scratchblocks for WP (WordPress plugin) (CVE-2026-6247). Risk of unauthorized operations or information disclosure. CVE-2026-6247
- Medium 6.4 Cross-Site Scripting (XSS) in BJ Lazy Load (WordPress plugin) Cross-site scripting in BJ Lazy Load (WordPress plugin) (CVE-2026-2300). Risk of unauthorized operations or information disclosure. Exploitable via preg_replace. CVE-2026-2300
- Medium 4.9 Cross-Site Scripting (XSS) in WP SEO Structured Data Schema (WordPress plugin) Cross-site scripting in WP SEO Structured Data Schema (WordPress plugin) (CVE-2026-3604). Risk of unauthorized operations or information disclosure. Exploitable via _kcseo_ative_tab. CVE-2026-3604
- Medium 6.1 Cross-Site Scripting (XSS) in Elecom Cross-site scripting in Elecom (CVE-2024-34577). Risk of unauthorized operations or information disclosure. CVE-2024-34577
- Medium 4.7 Cross-Site Scripting (XSS) in Sap Business Server Pages) Cross-site scripting in Sap Business Server Pages) (CVE-2026-27682). Risk of unauthorized operations or information disclosure. CVE-2026-27682
- High 8.7 Reserved. Details will be published at disclosure. Cross-site scripting reported (CVE-2026-45392). Confidential information can be exposed externally. CVE-2026-45392
- Critical 9.3 Cross-Site Scripting (XSS) in DeepChat Cross-site scripting in DeepChat (CVE-2026-43900). Confidential information can be exposed externally. Mitigation: upgrade to 1.0.4-beta.1 or later. CVE-2026-43900
- Medium 6.1 Cross-Site Scripting (XSS) in github.com/gofiber/fiber/v3 Cross-site scripting in github.com/gofiber/fiber/v3 (CVE-2026-42554). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.2.0 or later. CVE-2026-42554
- Medium 6.8 Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2026-45026). Confidential information can be exposed externally. Mitigation: upgrade to 3.7.3 or later. CVE-2026-45026
- Medium 6.8 Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2026-45025). Confidential information can be exposed externally. Mitigation: upgrade to 3.7.3 or later. CVE-2026-45025
- Medium 4.5 Cross-Site Scripting (XSS) in Audiobookshelf Cross-site scripting in Audiobookshelf (CVE-2026-42887). Confidential information can be exposed externally. Mitigation: upgrade to 2.33.0 or later. CVE-2026-42887
- Unrated Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2026-42870). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.7.0 or later. CVE-2026-42870
- Medium 6.1 Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2026-42872). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.7.0 or later. CVE-2026-42872
- Low 3.7 Vulnerability in microdot CVE-2026-42874
- Unrated Code Injection in mermaid CVE-2026-41149
- Unrated Cross-Site Scripting (XSS) in mantisbt/mantisbt Cross-site scripting in mantisbt/mantisbt (CVE-2026-40607). Risk of unauthorized operations or information disclosure. Exploitable via g_stored_query_create_threshold. Mitigation: upgrade to 2.28.2 or later. CVE-2026-40607
- Unrated Cross-Site Scripting (XSS) in mantisbt/mantisbt Cross-site scripting in mantisbt/mantisbt (CVE-2026-40598). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.28.2 or later. CVE-2026-40598
- Unrated Cross-Site Scripting (XSS) in mantisbt/mantisbt Cross-site scripting in mantisbt/mantisbt (CVE-2026-40597). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.28.2 or later. CVE-2026-40597
- Unrated Cross-Site Scripting (XSS) in mantisbt/mantisbt Cross-site scripting in mantisbt/mantisbt (CVE-2026-40596). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.28.2 or later. CVE-2026-40596