slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,588
- High 7.1 Cross-Site Scripting (XSS) in WPCHURCH Cross-site scripting in WPCHURCH (CVE-2025-31642). Risk of unauthorized operations or information disclosure. CVE-2025-31642
- High 7.1 Cross-Site Scripting (XSS) in Woocommerce Sales Funnel Builder Cross-site scripting in Woocommerce Sales Funnel Builder (CVE-2025-30631). Risk of unauthorized operations or information disclosure. CVE-2025-30631
- Medium 6.5 Cross-Site Scripting (XSS) in TheGem Theme Elements Cross-site scripting in TheGem Theme Elements (CVE-2025-69357). Risk of unauthorized operations or information disclosure. CVE-2025-69357
- Medium 5.9 Cross-Site Scripting (XSS) in UiChemy Cross-site scripting in UiChemy (CVE-2025-69362). Risk of unauthorized operations or information disclosure. CVE-2025-69362
- Medium 6.5 Cross-Site Scripting (XSS) in TheGem Theme Elements Cross-site scripting in TheGem Theme Elements (CVE-2025-69360). Risk of unauthorized operations or information disclosure. CVE-2025-69360
- Medium 5.9 Cross-Site Scripting (XSS) in Accordion Cross-site scripting in Accordion (CVE-2025-69350). Risk of unauthorized operations or information disclosure. CVE-2025-69350
- Medium 6.5 Cross-Site Scripting (XSS) in Wishlist for WooCommerce Cross-site scripting in Wishlist for WooCommerce (CVE-2025-69334). Risk of unauthorized operations or information disclosure. CVE-2025-69334
- Medium 6.5 Cross-Site Scripting (XSS) in Team Showcase Cross-site scripting in Team Showcase (CVE-2025-69335). Risk of unauthorized operations or information disclosure. CVE-2025-69335
- High 7.1 Cross-Site Scripting (XSS) in JobBank Cross-site scripting in JobBank (CVE-2025-69085). Risk of unauthorized operations or information disclosure. CVE-2025-69085
- High 7.1 Cross-Site Scripting (XSS) in Photo Gallery Cross-site scripting in Photo Gallery (CVE-2025-69084). Risk of unauthorized operations or information disclosure. CVE-2025-69084
- Medium 6.1 Cross-Site Scripting (XSS) in Joomla Cross-site scripting in Joomla (CVE-2025-63083). Risk of unauthorized operations or information disclosure. CVE-2025-63083
- Medium 6.1 Cross-Site Scripting (XSS) in Joomla Cross-site scripting in Joomla (CVE-2025-63082). Risk of unauthorized operations or information disclosure. CVE-2025-63082
- Medium 6.4 Cross-Site Scripting (XSS) in Phlox (WordPress theme) Cross-site scripting in Phlox (WordPress theme) (CVE-2025-4776). Risk of unauthorized operations or information disclosure. CVE-2025-4776
- High 7.2 Cross-Site Scripting (XSS) in vega-functions Cross-site scripting in vega-functions (CVE-2025-66648). Risk of unauthorized operations or information disclosure. Exploitable via vega.expressionInterpreter. Mitigation: upgrade to 6.1.1 or later. CVE-2025-66648
- High 8.1 Cross-Site Scripting (XSS) in Vega Cross-site scripting in Vega (CVE-2025-65110). Confidential information can be exposed externally. Exploitable via vega. CVE-2025-65110
- High 8.0 Vulnerability in Coollabs CVE-2025-59158
- Medium 6.5 Cross-Site Scripting (XSS) in Dokan Pro Cross-site scripting in Dokan Pro (CVE-2025-39497). Risk of unauthorized operations or information disclosure. CVE-2025-39497
- High 7.5 Cross-Site Scripting (XSS) in UCRM Argentina AFIP invoices Plugin Cross-site scripting in UCRM Argentina AFIP invoices Plugin (CVE-2025-59467). Successful exploitation can lead to full system takeover. CVE-2025-59467
- Unrated Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting… Cross-site scripting reported (CVE-2025-15022). Risk of unauthorized operations or information disclosure. CVE-2025-15022
- Low 3.5 Vulnerability in FlexTable (WordPress plugin) CVE-2025-9543
- Low 3.1 Cross-Site Scripting (XSS) in zhanglun lettura Cross-site scripting in zhanglun lettura (CVE-2025-15454). Risk of unauthorized operations or information disclosure. CVE-2025-15454
- Low 2.4 Cross-Site Scripting (XSS) in xnx3 wangmarket Cross-site scripting in xnx3 wangmarket (CVE-2025-15452). Risk of unauthorized operations or information disclosure. CVE-2025-15452
- Low 2.4 Cross-Site Scripting (XSS) in xnx3 wangmarket Cross-site scripting in xnx3 wangmarket (CVE-2025-15451). Risk of unauthorized operations or information disclosure. CVE-2025-15451
- Medium 5.4 Cross-Site Scripting (XSS) in Kentico Xperience Cross-site scripting in Kentico Xperience (CVE-2025-5591). Risk of unauthorized operations or information disclosure. CVE-2025-5591
- Medium 4.9 Cross-Site Scripting (XSS) in Artifactory Cross-site scripting in Artifactory (CVE-2025-14830). Confidential information can be exposed externally. CVE-2025-14830
- Medium 6.1 Cross-Site Scripting (XSS) in QuMagie Cross-site scripting in QuMagie (CVE-2025-62857). Risk of unauthorized operations or information disclosure. CVE-2025-62857
- Low 3.5 Cross-Site Scripting (XSS) in LigeroSmart Cross-site scripting in LigeroSmart (CVE-2025-15437). Risk of unauthorized operations or information disclosure. CVE-2025-15437
- Low 2.4 Cross-Site Scripting (XSS) in xnx3 wangmarket Cross-site scripting in xnx3 wangmarket (CVE-2025-15416). Risk of unauthorized operations or information disclosure. CVE-2025-15416
- Medium 6.1 Cross-Site Scripting (XSS) in Linux Windows Cross-site scripting in Linux Windows (CVE-2025-67709). Risk of unauthorized operations or information disclosure. CVE-2025-67709
- Medium 6.1 Cross-Site Scripting (XSS) in Linux Windows Cross-site scripting in Linux Windows (CVE-2025-67710). Risk of unauthorized operations or information disclosure. CVE-2025-67710