slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,588
- High 8.8 IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to… Cross-site scripting reported (CVE-2025-14499). Successful exploitation can lead to full system takeover. CVE-2025-14499
- High 7.3 Cross-Site Scripting (XSS) in Otello Cross-site scripting in Otello (CVE-2025-13183). Confidential information can be exposed externally. CVE-2025-13183
- Medium 6.5 Cross-Site Scripting (XSS) in TheGem Theme Elements Cross-site scripting in TheGem Theme Elements (CVE-2025-68559). Risk of unauthorized operations or information disclosure. CVE-2025-68559
- Medium 6.5 Cross-Site Scripting (XSS) in Responsive Posts Carousel Pro Cross-site scripting in Responsive Posts Carousel Pro (CVE-2025-68548). Risk of unauthorized operations or information disclosure. CVE-2025-68548
- Medium 6.4 Cross-Site Scripting (XSS) in Membership Plugin – Restrict Content (WordPress plugin) Cross-site scripting in Membership Plugin – Restrict Content (WordPress plugin) (CVE-2025-14000). Risk of unauthorized operations or information disclosure. CVE-2025-14000
- Medium 6.4 Cross-Site Scripting (XSS) in Happy Addons for Elementor (WordPress plugin) Cross-site scripting in Happy Addons for Elementor (WordPress plugin) (CVE-2025-14635). Risk of unauthorized operations or information disclosure. CVE-2025-14635
- Medium 6.4 Cross-Site Scripting (XSS) in Calendar (WordPress plugin) Cross-site scripting in Calendar (WordPress plugin) (CVE-2025-14548). Risk of unauthorized operations or information disclosure. CVE-2025-14548
- Medium 4.3 Cross-Site Scripting (XSS) in LibreNMS Cross-site scripting in LibreNMS (CVE-2025-68614). Risk of unauthorized operations or information disclosure. CVE-2025-68614
- Medium 6.1 Cross-Site Scripting (XSS) in Piranha CMS Cross-site scripting in Piranha CMS (CVE-2025-67290). Risk of unauthorized operations or information disclosure. CVE-2025-67290
- Medium 6.1 Cross-Site Scripting (XSS) in Piranha CMS Cross-site scripting in Piranha CMS (CVE-2025-67291). Risk of unauthorized operations or information disclosure. CVE-2025-67291
- Medium 6.8 Cross-Site Scripting (XSS) in Infra Monitoring Cross-site scripting in Infra Monitoring (CVE-2025-54890). Confidential information can be exposed externally. CVE-2025-54890
- Medium 6.8 Cross-Site Scripting (XSS) in Infra Monitoring Cross-site scripting in Infra Monitoring (CVE-2025-8460). Confidential information can be exposed externally. CVE-2025-8460
- Medium 6.5 Cross-Site Scripting (XSS) in Void Elementor WHMCS Elements For Elementor Page Builder Cross-site scripting in Void Elementor WHMCS Elements For Elementor Page Builder (CVE-2025-62094). Risk of unauthorized operations or information disclosure. CVE-2025-62094
- Medium 6.5 Cross-Site Scripting (XSS) in TempTool [Show Current Template Info] Cross-site scripting in TempTool [Show Current Template Info] (CVE-2025-62926). Risk of unauthorized operations or information disclosure. CVE-2025-62926
- Medium 6.5 Cross-Site Scripting (XSS) in WP Microdata Cross-site scripting in WP Microdata (CVE-2025-62901). Risk of unauthorized operations or information disclosure. CVE-2025-62901
- High 7.2 Cross-Site Scripting (XSS) in SureForms (WordPress plugin) Cross-site scripting in SureForms (WordPress plugin) (CVE-2025-14855). Risk of unauthorized operations or information disclosure. CVE-2025-14855
- High 7.2 Cross-Site Scripting (XSS) in ELEX WordPress HelpDesk & Customer Ticketing System (WordPress plugin) Cross-site scripting in ELEX WordPress HelpDesk & Customer Ticketing System (WordPress plugin) (CVE-2025-9343). Risk of unauthorized operations or information disclosure. CVE-2025-9343
- Medium 6.4 Cross-Site Scripting (XSS) in Image Photo Gallery Final Tiles Grid (WordPress plugin) Cross-site scripting in Image Photo Gallery Final Tiles Grid (WordPress plugin) (CVE-2025-13693). Risk of unauthorized operations or information disclosure. CVE-2025-13693
- Low 2.4 Cross-Site Scripting (XSS) in Campcodes Complete Online Beauty Parlor Management System Cross-site scripting in Campcodes Complete Online Beauty Parlor Management System (CVE-2025-14991). Risk of unauthorized operations or information disclosure. CVE-2025-14991
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13220). Risk of unauthorized operations or information disclosure. CVE-2025-13220
- Medium 6.1 Cross-Site Scripting (XSS) in Product Table for WooCommerce (WordPress plugin) Cross-site scripting in Product Table for WooCommerce (WordPress plugin) (CVE-2025-12398). Risk of unauthorized operations or information disclosure. CVE-2025-12398
- Medium 4.4 Cross-Site Scripting (XSS) in WC Builder – WooCommerce Page Builder for WPBakery (WordPress plugin) Cross-site scripting in WC Builder – WooCommerce Page Builder for WPBakery (WordPress plugin) (CVE-2025-14054). Risk of unauthorized operations or information disclosure. CVE-2025-14054
- Medium 6.4 Cross-Site Scripting (XSS) in WishSuite (WordPress plugin) Cross-site scripting in WishSuite (WordPress plugin) (CVE-2025-13838). Risk of unauthorized operations or information disclosure. CVE-2025-13838
- Medium 6.1 Cross-Site Scripting (XSS) in Five Star Restaurant Reservations – WordPress Booking Plugin (WordPress plugin) Cross-site scripting in Five Star Restaurant Reservations – WordPress Booking Plugin (WordPress plugin) (CVE-2025-11496). Risk of unauthorized operations or information disclosure. CVE-2025-11496
- High 7.6 Vulnerability in WP JobHunt (WordPress plugin) CVE-2025-7782
- Medium 5.5 Cross-Site Scripting (XSS) in Responsive and Swipe slider (WordPress plugin) Cross-site scripting in Responsive and Swipe slider (WordPress plugin) (CVE-2025-14721). Risk of unauthorized operations or information disclosure. CVE-2025-14721
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Stock System Cross-site scripting in code-projects Simple Stock System (CVE-2025-14962). Risk of unauthorized operations or information disclosure. CVE-2025-14962
- Medium 5.3 Unrestricted File Upload in Turms AI-Serving module Vulnerability in Turms AI-Serving module (CVE-2025-66908). Risk of unauthorized operations or information disclosure. CVE-2025-66908
- High 7.2 Cross-Site Scripting (XSS) in SlimStat Analytics (WordPress plugin) Cross-site scripting in SlimStat Analytics (WordPress plugin) (CVE-2025-14151). Risk of unauthorized operations or information disclosure. CVE-2025-14151
- Medium 6.3 Cross-Site Scripting (XSS) in Foxit Cross-site scripting in Foxit (CVE-2025-66519). Confidential information can be exposed externally. CVE-2025-66519