slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,588
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13728). Risk of unauthorized operations or information disclosure. Exploitable via fluent_auth_reset_password. CVE-2025-13728
- Medium 5.4 Cross-Site Scripting (XSS) in Elastic Kibana Cross-site scripting in Elastic Kibana (CVE-2025-37732). Risk of unauthorized operations or information disclosure. CVE-2025-37732
- High 7.1 Vulnerability in URL Shortify (WordPress plugin) CVE-2025-13355
- High 7.1 Vulnerability in URL Shortify (WordPress plugin) CVE-2025-12684
- Medium 5.4 Cross-Site Scripting (XSS) in MISP Cross-site scripting in MISP (CVE-2025-67906). Risk of unauthorized operations or information disclosure. CVE-2025-67906
- Medium 6.4 Cross-Site Scripting (XSS) in Lightweight Accordion (WordPress plugin) Cross-site scripting in Lightweight Accordion (WordPress plugin) (CVE-2025-13740). Risk of unauthorized operations or information disclosure. CVE-2025-13740
- Medium 4.3 Cross-Site Scripting (XSS) in mayan-edms Cross-site scripting in mayan-edms (CVE-2025-14691). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 4.10.2 or later. CVE-2025-14691
- Low 2.4 Cross-Site Scripting (XSS) in code-projects Student File Management System Cross-site scripting in code-projects Student File Management System (CVE-2025-14662). Risk of unauthorized operations or information disclosure. CVE-2025-14662
- Low 2.4 Cross-Site Scripting (XSS) in code-projects Student File Management System Cross-site scripting in code-projects Student File Management System (CVE-2025-14663). Risk of unauthorized operations or information disclosure. CVE-2025-14663
- Medium 6.4 Cross-Site Scripting (XSS) in Addon Elements for Elementor (WordPress plugin) Cross-site scripting in Addon Elements for Elementor (WordPress plugin) (CVE-2025-12537). Risk of unauthorized operations or information disclosure. CVE-2025-12537
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-9856). Risk of unauthorized operations or information disclosure. CVE-2025-9856
- Medium 6.4 Cross-Site Scripting (XSS) in a3 Lazy Load (WordPress plugin) Cross-site scripting in a3 Lazy Load (WordPress plugin) (CVE-2025-9873). Risk of unauthorized operations or information disclosure. CVE-2025-9873
- Medium 6.4 Cross-Site Scripting (XSS) in Redux Framework (WordPress plugin) Cross-site scripting in Redux Framework (WordPress plugin) (CVE-2025-9488). Risk of unauthorized operations or information disclosure. CVE-2025-9488
- Medium 6.4 Cross-Site Scripting (XSS) in Livemesh SiteOrigin Widgets (WordPress plugin) Cross-site scripting in Livemesh SiteOrigin Widgets (WordPress plugin) (CVE-2025-8780). Risk of unauthorized operations or information disclosure. CVE-2025-8780
- Medium 5.8 Vulnerability in WPS Visitor Counter (WordPress plugin) CVE-2025-9116
- Medium 6.4 Cross-Site Scripting (XSS) in All-in-One Addons for Elementor – WidgetKit (WordPress plugin) Cross-site scripting in All-in-One Addons for Elementor – WidgetKit (WordPress plugin) (CVE-2025-8779). Risk of unauthorized operations or information disclosure. CVE-2025-8779
- Medium 6.4 Cross-Site Scripting (XSS) in Enter Addons (WordPress plugin) Cross-site scripting in Enter Addons (WordPress plugin) (CVE-2025-8687). Risk of unauthorized operations or information disclosure. CVE-2025-8687
- Medium 6.4 Cross-Site Scripting (XSS) in YITH WooCommerce Quick View (WordPress plugin) Cross-site scripting in YITH WooCommerce Quick View (WordPress plugin) (CVE-2025-8617). Risk of unauthorized operations or information disclosure. CVE-2025-8617
- Medium 6.4 Cross-Site Scripting (XSS) in MarqueeAddons (WordPress plugin) Cross-site scripting in MarqueeAddons (WordPress plugin) (CVE-2025-8199). Risk of unauthorized operations or information disclosure. CVE-2025-8199
- Medium 6.4 Cross-Site Scripting (XSS) in Kingcabs (WordPress theme) Cross-site scripting in Kingcabs (WordPress theme) (CVE-2025-7058). Risk of unauthorized operations or information disclosure. CVE-2025-7058
- Medium 6.4 Cross-Site Scripting (XSS) in JetWidgets For Elementor (WordPress plugin) Cross-site scripting in JetWidgets For Elementor (WordPress plugin) (CVE-2025-8195). Risk of unauthorized operations or information disclosure. CVE-2025-8195
- Medium 6.4 Cross-Site Scripting (XSS) in King Addons for Elementor (WordPress plugin) Cross-site scripting in King Addons for Elementor (WordPress plugin) (CVE-2025-7960). Risk of unauthorized operations or information disclosure. CVE-2025-7960
- Medium 5.4 Cross-Site Scripting (XSS) in ShineLan-X Cross-site scripting in ShineLan-X (CVE-2025-36750). Risk of unauthorized operations or information disclosure. CVE-2025-36750
- Medium 5.4 Cross-Site Scripting (XSS) in ShineLan-X Cross-site scripting in ShineLan-X (CVE-2025-36748). Risk of unauthorized operations or information disclosure. CVE-2025-36748
- Medium 6.4 Cross-Site Scripting (XSS) in HT Slider for Elementor (WordPress plugin) Cross-site scripting in HT Slider for Elementor (WordPress plugin) (CVE-2025-14278). Risk of unauthorized operations or information disclosure. CVE-2025-14278
- Medium 4.4 Cross-Site Scripting (XSS) in Quick Testimonials (WordPress plugin) Cross-site scripting in Quick Testimonials (WordPress plugin) (CVE-2025-14378). Risk of unauthorized operations or information disclosure. CVE-2025-14378
- Medium 6.4 Cross-Site Scripting (XSS) in Custom Frames (WordPress plugin) Cross-site scripting in Custom Frames (WordPress plugin) (CVE-2025-13705). Risk of unauthorized operations or information disclosure. CVE-2025-13705
- Medium 4.4 Cross-Site Scripting (XSS) in Custom Post Type UI (WordPress plugin) Cross-site scripting in Custom Post Type UI (WordPress plugin) (CVE-2025-14056). Risk of unauthorized operations or information disclosure. CVE-2025-14056
- Medium 6.1 Cross-Site Scripting (XSS) in WP to LinkedIn Auto Publish (WordPress plugin) Cross-site scripting in WP to LinkedIn Auto Publish (WordPress plugin) (CVE-2025-12077). Risk of unauthorized operations or information disclosure. CVE-2025-12077
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12109). Risk of unauthorized operations or information disclosure. CVE-2025-12109