slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,588
- Medium 6.4 Cross-Site Scripting (XSS) in Colibri Page Builder (WordPress plugin) Cross-site scripting in Colibri Page Builder (WordPress plugin) (CVE-2025-11376). Risk of unauthorized operations or information disclosure. CVE-2025-11376
- Medium 6.1 Cross-Site Scripting (XSS) in Social Media Auto Publish (WordPress plugin) Cross-site scripting in Social Media Auto Publish (WordPress plugin) (CVE-2025-12076). Risk of unauthorized operations or information disclosure. CVE-2025-12076
- Medium 6.3 Cross-Site Scripting (XSS) in vuetify Cross-site scripting in vuetify (CVE-2025-8082). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.0.0 or later. CVE-2025-8082
- Medium 4.4 Cross-Site Scripting (XSS) in CISA Software Acquisition Guide Supplier Response Web Tool Cross-site scripting in CISA Software Acquisition Guide Supplier Response Web Tool (CVE-2025-67634). Risk of unauthorized operations or information disclosure. CVE-2025-67634
- Low 3.5 Cross-Site Scripting (XSS) in Qualitor Cross-site scripting in Qualitor (CVE-2025-14580). Risk of unauthorized operations or information disclosure. CVE-2025-14580
- Medium 5.4 Cross-Site Scripting (XSS) in Frappe Cross-site scripting in Frappe (CVE-2025-67734). Risk of unauthorized operations or information disclosure. CVE-2025-67734
- Medium 4.6 Cross-Site Scripting (XSS) in RuoYi Cross-site scripting in RuoYi (CVE-2025-67342). Risk of unauthorized operations or information disclosure. CVE-2025-67342
- Medium 4.6 Cross-Site Scripting (XSS) in jshERP Cross-site scripting in jshERP (CVE-2025-67344). Risk of unauthorized operations or information disclosure. CVE-2025-67344
- Medium 4.6 Cross-Site Scripting (XSS) in jshERP Cross-site scripting in jshERP (CVE-2025-67341). Risk of unauthorized operations or information disclosure. CVE-2025-67341
- Medium 5.4 Cross-Site Scripting (XSS) in Solaredge Cross-site scripting in Solaredge (CVE-2025-36746). Risk of unauthorized operations or information disclosure. CVE-2025-36746
- Medium 6.4 Cross-Site Scripting (XSS) in Magical Posts Display (WordPress plugin) Cross-site scripting in Magical Posts Display (WordPress plugin) (CVE-2025-12965). Risk of unauthorized operations or information disclosure. CVE-2025-12965
- Medium 6.4 Cross-Site Scripting (XSS) in AI Feeds (WordPress plugin) Cross-site scripting in AI Feeds (WordPress plugin) (CVE-2025-14030). Risk of unauthorized operations or information disclosure. CVE-2025-14030
- Medium 5.5 Cross-Site Scripting (XSS) in MailerLite – Signup forms (WordPress plugin) Cross-site scripting in MailerLite – Signup forms (WordPress plugin) (CVE-2025-13993). Risk of unauthorized operations or information disclosure. CVE-2025-13993
- Medium 5.5 Cross-Site Scripting (XSS) in BSK PDF Manager (WordPress plugin) Cross-site scripting in BSK PDF Manager (WordPress plugin) (CVE-2025-4970). Risk of unauthorized operations or information disclosure. CVE-2025-4970
- Medium 6.4 Cross-Site Scripting (XSS) in Mailgun Subscriptions (WordPress plugin) Cross-site scripting in Mailgun Subscriptions (WordPress plugin) (CVE-2025-11876). Risk of unauthorized operations or information disclosure. CVE-2025-11876
- Medium 6.1 Cross-Site Scripting (XSS) in VikRentItems Flexible Rental Management System (WordPress plugin) Cross-site scripting in VikRentItems Flexible Rental Management System (WordPress plugin) (CVE-2025-14049). Risk of unauthorized operations or information disclosure. CVE-2025-14049
- High 7.2 Cross-Site Scripting (XSS) in Fancy Product Designer (WordPress plugin) Cross-site scripting in Fancy Product Designer (WordPress plugin) (CVE-2025-12570). Risk of unauthorized operations or information disclosure. CVE-2025-12570
- Medium 5.4 Cross-Site Scripting (XSS) in Groupsession Cross-site scripting in Groupsession (CVE-2025-66284). Risk of unauthorized operations or information disclosure. CVE-2025-66284
- Medium 6.1 Cross-Site Scripting (XSS) in GroupSession Free edition Cross-site scripting in GroupSession Free edition (CVE-2025-65120). Risk of unauthorized operations or information disclosure. CVE-2025-65120
- Medium 6.1 Cross-Site Scripting (XSS) in GroupSession Free edition Cross-site scripting in GroupSession Free edition (CVE-2025-57883). Risk of unauthorized operations or information disclosure. CVE-2025-57883
- Medium 6.1 Cross-Site Scripting (XSS) in GroupSession Free edition Cross-site scripting in GroupSession Free edition (CVE-2025-54407). Risk of unauthorized operations or information disclosure. CVE-2025-54407
- Medium 5.4 Cross-Site Scripting (XSS) in Groupsession Cross-site scripting in Groupsession (CVE-2025-53523). Risk of unauthorized operations or information disclosure. CVE-2025-53523
- High 8.2 Cross-Site Scripting (XSS) in Masa CMS Cross-site scripting in Masa CMS (CVE-2025-66492). Confidential information can be exposed externally. CVE-2025-66492
- Medium 6.4 Cross-Site Scripting (XSS) in Wpik WordPress Basic Ajax Form (WordPress plugin) Cross-site scripting in Wpik WordPress Basic Ajax Form (WordPress plugin) (CVE-2025-14393). Risk of unauthorized operations or information disclosure. CVE-2025-14393
- Medium 4.4 Cross-Site Scripting (XSS) in WP Job Portal (WordPress plugin) Cross-site scripting in WP Job Portal (WordPress plugin) (CVE-2025-14467). Risk of unauthorized operations or information disclosure. Exploitable via WPJOBPORTAL_ALLOWED_TAGS. CVE-2025-14467
- Medium 6.1 Cross-Site Scripting (XSS) in WPLG Default Mail From (WordPress plugin) Cross-site scripting in WPLG Default Mail From (WordPress plugin) (CVE-2025-14138). Risk of unauthorized operations or information disclosure. CVE-2025-14138
- Medium 6.4 Cross-Site Scripting (XSS) in Ayo Shortcodes (WordPress plugin) Cross-site scripting in Ayo Shortcodes (WordPress plugin) (CVE-2025-14143). Risk of unauthorized operations or information disclosure. CVE-2025-14143
- Medium 6.1 Cross-Site Scripting (XSS) in Simple AL Slider (WordPress plugin) Cross-site scripting in Simple AL Slider (WordPress plugin) (CVE-2025-14137). Risk of unauthorized operations or information disclosure. CVE-2025-14137
- Medium 6.1 Cross-Site Scripting (XSS) in Like DisLike Voting (WordPress plugin) Cross-site scripting in Like DisLike Voting (WordPress plugin) (CVE-2025-14129). Risk of unauthorized operations or information disclosure. CVE-2025-14129
- Medium 6.1 Cross-Site Scripting (XSS) in Complag (WordPress plugin) Cross-site scripting in Complag (WordPress plugin) (CVE-2025-14125). Risk of unauthorized operations or information disclosure. CVE-2025-14125