slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 6.1 Cross-Site Scripting (XSS) in AIL Framework Cross-site scripting in AIL Framework (CVE-2026-39416). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 6.8 or later. CVE-2026-39416
- High 7.3 Cross-Site Scripting (XSS) in immich Cross-site scripting in immich (CVE-2026-35455). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 2.7.0 or later. CVE-2026-35455
- High 8.7 Cross-Site Scripting (XSS) in Mcgill Cross-site scripting in Mcgill (CVE-2026-35169). Confidential information can be exposed externally. Mitigation: upgrade to 27.0.3 or later. CVE-2026-35169
- Medium 6.5 Cross-Site Scripting (XSS) in Mcgill Cross-site scripting in Mcgill (CVE-2026-35403). Confidential information can be exposed externally. Mitigation: upgrade to 27.0.3 or later. CVE-2026-35403
- Medium 6.4 Cross-Site Scripting (XSS) in Page Builder: Pagelayer (WordPress plugin) Cross-site scripting in Page Builder: Pagelayer (WordPress plugin) (CVE-2026-2509). Risk of unauthorized operations or information disclosure. CVE-2026-2509
- High 7.6 Cross-Site Scripting (XSS) in Coolercontrol Cross-site scripting in Coolercontrol (CVE-2026-5301). Data can be tampered with by attackers. CVE-2026-5301
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-2481). Risk of unauthorized operations or information disclosure. CVE-2026-2481
- Medium 6.4 Cross-Site Scripting (XSS) in WP Visitor Statistics (WordPress plugin) Cross-site scripting in WP Visitor Statistics (WordPress plugin) (CVE-2026-4303). Risk of unauthorized operations or information disclosure. CVE-2026-4303
- Medium 6.4 Cross-Site Scripting (XSS) in pdfl.io (WordPress plugin) Cross-site scripting in pdfl.io (WordPress plugin) (CVE-2026-4073). Risk of unauthorized operations or information disclosure. CVE-2026-4073
- Medium 6.4 Cross-Site Scripting (XSS) in Robo Gallery (WordPress plugin) Cross-site scripting in Robo Gallery (WordPress plugin) (CVE-2026-4300). Risk of unauthorized operations or information disclosure. Exploitable via rbs_gallery_LoadingWord. CVE-2026-4300
- Medium 6.4 Cross-Site Scripting (XSS) in PrivateContent Free (WordPress plugin) Cross-site scripting in PrivateContent Free (WordPress plugin) (CVE-2026-4025). Risk of unauthorized operations or information disclosure. CVE-2026-4025
- Medium 5.3 Vulnerability in tagDiv Composer CVE-2026-39712
- Medium 6.5 Cross-Site Scripting (XSS) in UiCore Elements Cross-site scripting in UiCore Elements (CVE-2026-39708). Risk of unauthorized operations or information disclosure. CVE-2026-39708
- Medium 6.5 Cross-Site Scripting (XSS) in Elfsight WhatsApp Chat CC Cross-site scripting in Elfsight WhatsApp Chat CC (CVE-2026-39696). Risk of unauthorized operations or information disclosure. CVE-2026-39696
- Medium 6.5 Cross-Site Scripting (XSS) in Animation Addons for Elementor Cross-site scripting in Animation Addons for Elementor (CVE-2026-39702). Risk of unauthorized operations or information disclosure. CVE-2026-39702
- Medium 6.5 Cross-Site Scripting (XSS) in WPBITS Addons For Elementor Page Builder Cross-site scripting in WPBITS Addons For Elementor Page Builder (CVE-2026-39703). Risk of unauthorized operations or information disclosure. CVE-2026-39703
- Medium 6.5 Cross-Site Scripting (XSS) in tagDiv Composer Cross-site scripting in tagDiv Composer (CVE-2026-39692). Risk of unauthorized operations or information disclosure. CVE-2026-39692
- Medium 5.9 Cross-Site Scripting (XSS) in FSM Custom Featured Image Caption Cross-site scripting in FSM Custom Featured Image Caption (CVE-2026-39693). Risk of unauthorized operations or information disclosure. CVE-2026-39693
- Medium 5.9 Cross-Site Scripting (XSS) in Garden Gnome Package Cross-site scripting in Garden Gnome Package (CVE-2026-39683). Risk of unauthorized operations or information disclosure. CVE-2026-39683
- Medium 5.9 Cross-Site Scripting (XSS) in Korea SNS Cross-site scripting in Korea SNS (CVE-2026-39667). Risk of unauthorized operations or information disclosure. CVE-2026-39667
- Medium 6.5 Cross-Site Scripting (XSS) in MK Google Directions Cross-site scripting in MK Google Directions (CVE-2026-39674). Risk of unauthorized operations or information disclosure. CVE-2026-39674
- Medium 6.5 Cross-Site Scripting (XSS) in SEO Friendly Images Cross-site scripting in SEO Friendly Images (CVE-2026-39665). Risk of unauthorized operations or information disclosure. CVE-2026-39665
- Medium 6.5 Cross-Site Scripting (XSS) in Hello Bar Popup Builder Cross-site scripting in Hello Bar Popup Builder (CVE-2026-39666). Risk of unauthorized operations or information disclosure. CVE-2026-39666
- Medium 5.9 Cross-Site Scripting (XSS) in WP Simple HTML Sitemap Cross-site scripting in WP Simple HTML Sitemap (CVE-2026-39654). Risk of unauthorized operations or information disclosure. CVE-2026-39654
- Medium 6.5 Cross-Site Scripting (XSS) in Leaflet Map Cross-site scripting in Leaflet Map (CVE-2026-39646). Risk of unauthorized operations or information disclosure. CVE-2026-39646
- Medium 6.5 Cross-Site Scripting (XSS) in Livemesh Addons for Elementor Cross-site scripting in Livemesh Addons for Elementor (CVE-2026-39636). Risk of unauthorized operations or information disclosure. CVE-2026-39636
- Medium 5.9 Cross-Site Scripting (XSS) in Qubely Cross-site scripting in Qubely (CVE-2026-39638). Risk of unauthorized operations or information disclosure. CVE-2026-39638
- Medium 5.3 Vulnerability in DukaMarket CVE-2026-39628
- Medium 5.3 Vulnerability in Uminex CVE-2026-39629
- Medium 5.3 Vulnerability in TechOne CVE-2026-39625