slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- High 7.2 Cross-Site Scripting (XSS) in MyBB Downloads Plugin Cross-site scripting in MyBB Downloads Plugin (CVE-2018-25248). Risk of unauthorized operations or information disclosure. CVE-2018-25248
- Medium 6.4 Cross-Site Scripting (XSS) in MyBB My Arcade Plugin Cross-site scripting in MyBB My Arcade Plugin (CVE-2018-25249). Risk of unauthorized operations or information disclosure. CVE-2018-25249
- High 7.2 Cross-Site Scripting (XSS) in Visitor Traffic Real Time Statistics (WordPress plugin) Cross-site scripting in Visitor Traffic Real Time Statistics (WordPress plugin) (CVE-2026-2936). Risk of unauthorized operations or information disclosure. CVE-2026-2936
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-0626). Risk of unauthorized operations or information disclosure. CVE-2026-0626
- High 7.2 Cross-Site Scripting (XSS) in Widgets for Social Photo Feed (WordPress plugin) Cross-site scripting in Widgets for Social Photo Feed (WordPress plugin) (CVE-2026-5425). Risk of unauthorized operations or information disclosure. CVE-2026-5425
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-2437). Risk of unauthorized operations or information disclosure. CVE-2026-2437
- Medium 6.4 Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate (WordPress plugin) Cross-site scripting in WP Shortcodes Plugin - Shortcodes Ultimate (WordPress plugin) (CVE-2026-0737). Risk of unauthorized operations or information disclosure. CVE-2026-0737
- Medium 6.4 Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate (WordPress plugin) Cross-site scripting in WP Shortcodes Plugin - Shortcodes Ultimate (WordPress plugin) (CVE-2026-0738). Risk of unauthorized operations or information disclosure. CVE-2026-0738
- Medium 6.4 Cross-Site Scripting (XSS) in ElementsKit Elementor Addons and Templates (WordPress plugin) Cross-site scripting in ElementsKit Elementor Addons and Templates (WordPress plugin) (CVE-2026-2600). Risk of unauthorized operations or information disclosure. CVE-2026-2600
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-15064). Risk of unauthorized operations or information disclosure. CVE-2025-15064
- Medium 6.4 Cross-Site Scripting (XSS) in Simple Shopping Cart (WordPress plugin) Cross-site scripting in Simple Shopping Cart (WordPress plugin) (CVE-2026-0552). Risk of unauthorized operations or information disclosure. CVE-2026-0552
- Medium 6.4 Cross-Site Scripting (XSS) in Royal Addons for Elementor (WordPress plugin) Cross-site scripting in Royal Addons for Elementor (WordPress plugin) (CVE-2026-0664). Risk of unauthorized operations or information disclosure. CVE-2026-0664
- Medium 6.4 Cross-Site Scripting (XSS) in Xpro Addons — 140+ Widgets for Elementor (WordPress plugin) Cross-site scripting in Xpro Addons — 140+ Widgets for Elementor (WordPress plugin) (CVE-2025-13368). Risk of unauthorized operations or information disclosure. CVE-2025-13368
- Medium 6.4 Cross-Site Scripting (XSS) in Xpro Addons — 140+ Widgets for Elementor (WordPress plugin) Cross-site scripting in Xpro Addons — 140+ Widgets for Elementor (WordPress plugin) (CVE-2026-2949). Risk of unauthorized operations or information disclosure. CVE-2026-2949
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-2924). Risk of unauthorized operations or information disclosure. CVE-2026-2924
- High 8.3 Vulnerability in Electron CVE-2026-34780
- Medium 6.1 Cross-Site Scripting (XSS) in Emlog Cross-site scripting in Emlog (CVE-2026-34229). Risk of unauthorized operations or information disclosure. CVE-2026-34229
- Low 3.5 Cross-Site Scripting (XSS) in github.com/casdoor/casdoor Cross-site scripting in github.com/casdoor/casdoor (CVE-2026-5468). Risk of unauthorized operations or information disclosure. CVE-2026-5468
- High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-27655). Confidential information can be exposed externally. CVE-2026-27655
- High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-4107). Confidential information can be exposed externally. CVE-2026-4107
- High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-4108). Confidential information can be exposed externally. CVE-2026-4108
- High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-3879). Confidential information can be exposed externally. CVE-2026-3879
- High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-3880). Confidential information can be exposed externally. CVE-2026-3880
- High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-28703). Confidential information can be exposed externally. CVE-2026-28703
- High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-28754). Confidential information can be exposed externally. CVE-2026-28754
- High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-28756). Confidential information can be exposed externally. CVE-2026-28756
- Medium 6.1 Cross-Site Scripting (XSS) in Roundcube Webmail Cross-site scripting in Roundcube Webmail (CVE-2026-35539). Risk of unauthorized operations or information disclosure. CVE-2026-35539
- Medium 6.1 Cross-Site Scripting (XSS) in dompurify Cross-site scripting in dompurify (CVE-2026-65912). Risk of unauthorized operations or information disclosure. Exploitable via ADD_ATTR. Mitigation: upgrade to 3.3.2 or later. CVE-2026-65912
- Medium 6.1 Vulnerability in dompurify CVE-2026-65913
- Medium 5.4 Cross-Site Scripting (XSS) in Shynet Cross-site scripting in Shynet (CVE-2026-35508). Risk of unauthorized operations or information disclosure. CVE-2026-35508