slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- High 7.1 Cross-Site Scripting (XSS) in Taskbuilder Cross-site scripting in Taskbuilder (CVE-2025-67933). Risk of unauthorized operations or information disclosure. CVE-2025-67933
- High 7.1 Cross-Site Scripting (XSS) in Listeo Core Cross-site scripting in Listeo Core (CVE-2025-67932). Risk of unauthorized operations or information disclosure. CVE-2025-67932
- High 7.1 Cross-Site Scripting (XSS) in eHive Search Cross-site scripting in eHive Search (CVE-2025-67930). Risk of unauthorized operations or information disclosure. CVE-2025-67930
- High 7.1 Cross-Site Scripting (XSS) in Link Whisper Free Cross-site scripting in Link Whisper Free (CVE-2025-67927). Risk of unauthorized operations or information disclosure. CVE-2025-67927
- High 7.1 Cross-Site Scripting (XSS) in Grand Restaurant Cross-site scripting in Grand Restaurant (CVE-2025-67922). Risk of unauthorized operations or information disclosure. CVE-2025-67922
- High 7.1 Cross-Site Scripting (XSS) in Jobify Cross-site scripting in Jobify (CVE-2025-67916). Risk of unauthorized operations or information disclosure. CVE-2025-67916
- High 7.1 Cross-Site Scripting (XSS) in Woffice Cross-site scripting in Woffice (CVE-2025-67918). Risk of unauthorized operations or information disclosure. CVE-2025-67918
- High 7.1 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-27004). Risk of unauthorized operations or information disclosure. CVE-2025-27004
- High 7.1 Cross-Site Scripting (XSS) in CountDown With Image or Video Background Cross-site scripting in CountDown With Image or Video Background (CVE-2025-27002). Risk of unauthorized operations or information disclosure. CVE-2025-27002
- High 7.1 Cross-Site Scripting (XSS) in WP Virtual Assistant Cross-site scripting in WP Virtual Assistant (CVE-2025-22725). Risk of unauthorized operations or information disclosure. CVE-2025-22725
- Medium 6.4 Cross-Site Scripting (XSS) in Gutenverse Form (WordPress plugin) Cross-site scripting in Gutenverse Form (WordPress plugin) (CVE-2025-14984). Risk of unauthorized operations or information disclosure. CVE-2025-14984
- Medium 5.4 Cross-Site Scripting (XSS) in Ngsurvey Cross-site scripting in Ngsurvey (CVE-2025-15479). Risk of unauthorized operations or information disclosure. CVE-2025-15479
- High 7.1 Cross-Site Scripting (XSS) in WidgetKit Pro Cross-site scripting in WidgetKit Pro (CVE-2025-46494). Risk of unauthorized operations or information disclosure. CVE-2025-46494
- High 7.1 Cross-Site Scripting (XSS) in Arlo Cross-site scripting in Arlo (CVE-2025-69082). Risk of unauthorized operations or information disclosure. CVE-2025-69082
- High 7.1 Cross-Site Scripting (XSS) in DZS Video Gallery Cross-site scripting in DZS Video Gallery (CVE-2025-32300). Risk of unauthorized operations or information disclosure. CVE-2025-32300
- Medium 6.4 Vulnerability in Responsive Pricing Table (WordPress plugin) CVE-2025-15058
- Medium 4.4 Cross-Site Scripting (XSS) in Page Keys (WordPress plugin) Cross-site scripting in Page Keys (WordPress plugin) (CVE-2025-15000). Risk of unauthorized operations or information disclosure. CVE-2025-15000
- Medium 6.1 Cross-Site Scripting (XSS) in HBLPAY Payment Gateway for WooCommerce (WordPress plugin) Cross-site scripting in HBLPAY Payment Gateway for WooCommerce (WordPress plugin) (CVE-2025-14875). Risk of unauthorized operations or information disclosure. CVE-2025-14875
- Medium 4.4 Cross-Site Scripting (XSS) in twinklesmtp – Email Service Provider For (WordPress plugin) Cross-site scripting in twinklesmtp – Email Service Provider For (WordPress plugin) (CVE-2025-14887). Risk of unauthorized operations or information disclosure. CVE-2025-14887
- Medium 4.4 Cross-Site Scripting (XSS) in Simple User Meta Editor (WordPress plugin) Cross-site scripting in Simple User Meta Editor (WordPress plugin) (CVE-2025-14888). Risk of unauthorized operations or information disclosure. CVE-2025-14888
- Medium 6.4 Cross-Site Scripting (XSS) in Customer Reviews for WooCommerce (WordPress plugin) Cross-site scripting in Customer Reviews for WooCommerce (WordPress plugin) (CVE-2025-14891). Risk of unauthorized operations or information disclosure. CVE-2025-14891
- Medium 4.4 Vulnerability in Key Figures (WordPress plugin) CVE-2025-14792
- Medium 6.4 Cross-Site Scripting (XSS) in My Album Gallery (WordPress plugin) Cross-site scripting in My Album Gallery (WordPress plugin) (CVE-2025-14796). Risk of unauthorized operations or information disclosure. CVE-2025-14796
- Medium 6.1 Unrestricted File Upload in WordPress Vulnerability in WordPress (CVE-2025-14842). Risk of unauthorized operations or information disclosure. CVE-2025-14842
- High 7.1 Vulnerability in WP Photo Album Plus (WordPress plugin) CVE-2025-14835
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13887). Risk of unauthorized operations or information disclosure. Exploitable via ai_botkit_widget. CVE-2025-13887
- High 7.1 Cross-Site Scripting (XSS) in WPCHURCH Cross-site scripting in WPCHURCH (CVE-2025-31642). Risk of unauthorized operations or information disclosure. CVE-2025-31642
- High 7.1 Cross-Site Scripting (XSS) in Woocommerce Sales Funnel Builder Cross-site scripting in Woocommerce Sales Funnel Builder (CVE-2025-30631). Risk of unauthorized operations or information disclosure. CVE-2025-30631
- Medium 6.5 Cross-Site Scripting (XSS) in TheGem Theme Elements Cross-site scripting in TheGem Theme Elements (CVE-2025-69360). Risk of unauthorized operations or information disclosure. CVE-2025-69360
- Medium 6.5 Cross-Site Scripting (XSS) in TheGem Theme Elements Cross-site scripting in TheGem Theme Elements (CVE-2025-69357). Risk of unauthorized operations or information disclosure. CVE-2025-69357