slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 5.3 Vulnerability in Armania CVE-2026-39626
- Medium 5.9 Cross-Site Scripting (XSS) in Download Manager Cross-site scripting in Download Manager (CVE-2026-39615). Risk of unauthorized operations or information disclosure. CVE-2026-39615
- Medium 5.9 Cross-Site Scripting (XSS) in MyBookTable Bookstore Cross-site scripting in MyBookTable Bookstore (CVE-2026-39604). Risk of unauthorized operations or information disclosure. CVE-2026-39604
- Medium 6.5 Cross-Site Scripting (XSS) in Custom Query Blocks Cross-site scripting in Custom Query Blocks (CVE-2026-39575). Risk of unauthorized operations or information disclosure. CVE-2026-39575
- Medium 5.9 Cross-Site Scripting (XSS) in Hydra Booking Cross-site scripting in Hydra Booking (CVE-2026-39541). Risk of unauthorized operations or information disclosure. CVE-2026-39541
- Medium 6.5 Cross-Site Scripting (XSS) in Blog Filter Cross-site scripting in Blog Filter (CVE-2026-39517). Risk of unauthorized operations or information disclosure. CVE-2026-39517
- Medium 6.5 Cross-Site Scripting (XSS) in themesflat-addons-for-elementor Cross-site scripting in themesflat-addons-for-elementor (CVE-2026-39500). Risk of unauthorized operations or information disclosure. CVE-2026-39500
- Medium 6.5 Cross-Site Scripting (XSS) in Advanced Coupons for WooCommerce Coupons Cross-site scripting in Advanced Coupons for WooCommerce Coupons (CVE-2026-39508). Risk of unauthorized operations or information disclosure. CVE-2026-39508
- Medium 6.5 Cross-Site Scripting (XSS) in Post Expirator Cross-site scripting in Post Expirator (CVE-2026-39482). Risk of unauthorized operations or information disclosure. CVE-2026-39482
- Medium 6.5 Cross-Site Scripting (XSS) in One Expansion Unit vk-all-in-one-expansion-unit Cross-site scripting in One Expansion Unit vk-all-in-one-expansion-unit (CVE-2026-39483). Risk of unauthorized operations or information disclosure. CVE-2026-39483
- Medium 6.4 Cross-Site Scripting (XSS) in Magic Conversation For Gravity Forms (WordPress plugin) Cross-site scripting in Magic Conversation For Gravity Forms (WordPress plugin) (CVE-2026-1396). Risk of unauthorized operations or information disclosure. CVE-2026-1396
- Medium 6.4 Cross-Site Scripting (XSS) in Element Pack Addons for Elementor (WordPress plugin) Cross-site scripting in Element Pack Addons for Elementor (WordPress plugin) (CVE-2026-4655). Risk of unauthorized operations or information disclosure. CVE-2026-4655
- Medium 6.4 Cross-Site Scripting (XSS) in Wavr (WordPress plugin) Cross-site scripting in Wavr (WordPress plugin) (CVE-2026-5506). Risk of unauthorized operations or information disclosure. Exploitable via wave. CVE-2026-5506
- Medium 6.4 Cross-Site Scripting (XSS) in WowPress (WordPress plugin) Cross-site scripting in WowPress (WordPress plugin) (CVE-2026-5508). Risk of unauthorized operations or information disclosure. Exploitable via wowpress. CVE-2026-5508
- Medium 4.4 Cross-Site Scripting (XSS) in Inquiry Form to Posts or Pages (WordPress plugin) Cross-site scripting in Inquiry Form to Posts or Pages (WordPress plugin) (CVE-2026-5169). Risk of unauthorized operations or information disclosure. CVE-2026-5169
- Medium 6.4 Cross-Site Scripting (XSS) in Sports Club Management (WordPress plugin) Cross-site scripting in Sports Club Management (WordPress plugin) (CVE-2026-4871). Risk of unauthorized operations or information disclosure. Exploitable via scm_member_data. CVE-2026-4871
- Medium 6.4 Cross-Site Scripting (XSS) in Columns by BestWebSoft (WordPress plugin) Cross-site scripting in Columns by BestWebSoft (WordPress plugin) (CVE-2026-3618). Risk of unauthorized operations or information disclosure. CVE-2026-3618
- Medium 4.4 Cross-Site Scripting (XSS) in Whole Enquiry Cart for WooCommerce (WordPress plugin) Cross-site scripting in Whole Enquiry Cart for WooCommerce (WordPress plugin) (CVE-2026-2838). Risk of unauthorized operations or information disclosure. CVE-2026-2838
- Medium 6.4 Cross-Site Scripting (XSS) in Pinterest Site Verification plugin using Meta Tag (WordPress plugin) Cross-site scripting in Pinterest Site Verification plugin using Meta Tag (WordPress plugin) (CVE-2026-3142). Risk of unauthorized operations or information disclosure. CVE-2026-3142
- Medium 5.4 Cross-Site Scripting (XSS) in AM LottiePlayer (WordPress plugin) Cross-site scripting in AM LottiePlayer (WordPress plugin) (CVE-2025-1794). Risk of unauthorized operations or information disclosure. CVE-2025-1794
- Medium 5.4 Cross-Site Scripting (XSS) in MATCHA SNS Cross-site scripting in MATCHA SNS (CVE-2026-27787). Risk of unauthorized operations or information disclosure. CVE-2026-27787
- Medium 6.4 Cross-Site Scripting (XSS) in LearnPress – WordPress LMS Plugin (WordPress plugin) Cross-site scripting in LearnPress – WordPress LMS Plugin (WordPress plugin) (CVE-2026-4333). Risk of unauthorized operations or information disclosure. CVE-2026-4333
- Medium 6.4 Cross-Site Scripting (XSS) in Prime Slider – Addons for Elementor (WordPress plugin) Cross-site scripting in Prime Slider – Addons for Elementor (WordPress plugin) (CVE-2026-4341). Risk of unauthorized operations or information disclosure. Exploitable via follow_us_text. CVE-2026-4341
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-4785). Risk of unauthorized operations or information disclosure. CVE-2026-4785
- Medium 6.4 Cross-Site Scripting (XSS) in TableOn – WordPress Posts Table Filterable (WordPress plugin) Cross-site scripting in TableOn – WordPress Posts Table Filterable (WordPress plugin) (CVE-2026-3513). Risk of unauthorized operations or information disclosure. CVE-2026-3513
- Medium 6.4 Cross-Site Scripting (XSS) in Investi (WordPress plugin) Cross-site scripting in Investi (WordPress plugin) (CVE-2026-3600). Risk of unauthorized operations or information disclosure. CVE-2026-3600
- Medium 6.4 Cross-Site Scripting (XSS) in Strong Testimonials (WordPress plugin) Cross-site scripting in Strong Testimonials (WordPress plugin) (CVE-2026-3239). Risk of unauthorized operations or information disclosure. CVE-2026-3239
- Medium 6.4 Cross-Site Scripting (XSS) in LightPress Lightbox (WordPress plugin) Cross-site scripting in LightPress Lightbox (WordPress plugin) (CVE-2026-4379). Risk of unauthorized operations or information disclosure. Exploitable via group. CVE-2026-4379
- Medium 6.4 Cross-Site Scripting (XSS) in Blubrry PowerPress (WordPress plugin) Cross-site scripting in Blubrry PowerPress (WordPress plugin) (CVE-2026-2988). Risk of unauthorized operations or information disclosure. CVE-2026-2988
- Medium 6.4 Vulnerability in WordPress CVE-2025-14732