slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,591
- Medium 6.1 Cross-Site Scripting (XSS) in Simple AL Slider (WordPress plugin) Cross-site scripting in Simple AL Slider (WordPress plugin) (CVE-2025-14137). Risk of unauthorized operations or information disclosure. CVE-2025-14137
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-14119). Risk of unauthorized operations or information disclosure. CVE-2025-14119
- Medium 6.1 Cross-Site Scripting (XSS) in Category Dropdown List (WordPress plugin) Cross-site scripting in Category Dropdown List (WordPress plugin) (CVE-2025-14132). Risk of unauthorized operations or information disclosure. CVE-2025-14132
- Medium 6.1 Cross-Site Scripting (XSS) in Like DisLike Voting (WordPress plugin) Cross-site scripting in Like DisLike Voting (WordPress plugin) (CVE-2025-14129). Risk of unauthorized operations or information disclosure. CVE-2025-14129
- Medium 6.1 Cross-Site Scripting (XSS) in Complag (WordPress plugin) Cross-site scripting in Complag (WordPress plugin) (CVE-2025-14125). Risk of unauthorized operations or information disclosure. CVE-2025-14125
- Medium 4.4 Cross-Site Scripting (XSS) in DebateMaster (WordPress plugin) Cross-site scripting in DebateMaster (WordPress plugin) (CVE-2025-14035). Risk of unauthorized operations or information disclosure. CVE-2025-14035
- Medium 4.4 Cross-Site Scripting (XSS) in SimplyConvert (WordPress plugin) Cross-site scripting in SimplyConvert (WordPress plugin) (CVE-2025-14048). Risk of unauthorized operations or information disclosure. CVE-2025-14048
- Medium 6.4 Cross-Site Scripting (XSS) in Bold Timeline Lite (WordPress plugin) Cross-site scripting in Bold Timeline Lite (WordPress plugin) (CVE-2025-14032). Risk of unauthorized operations or information disclosure. CVE-2025-14032
- Medium 6.4 Cross-Site Scripting (XSS) in WP Dropzone (WordPress plugin) Cross-site scripting in WP Dropzone (WordPress plugin) (CVE-2025-13989). Risk of unauthorized operations or information disclosure. CVE-2025-13989
- Medium 6.1 Cross-Site Scripting (XSS) in 评论小秘书 (WordPress plugin) Cross-site scripting in 评论小秘书 (WordPress plugin) (CVE-2025-13988). Risk of unauthorized operations or information disclosure. CVE-2025-13988
- Medium 4.4 Cross-Site Scripting (XSS) in TWW Protein Calculator (WordPress plugin) Cross-site scripting in TWW Protein Calculator (WordPress plugin) (CVE-2025-13971). Risk of unauthorized operations or information disclosure. CVE-2025-13971
- Medium 4.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13975). Risk of unauthorized operations or information disclosure. CVE-2025-13975
- Medium 6.4 Cross-Site Scripting (XSS) in Paypal Payment Shortcode (WordPress plugin) Cross-site scripting in Paypal Payment Shortcode (WordPress plugin) (CVE-2025-13966). Risk of unauthorized operations or information disclosure. CVE-2025-13966
- Medium 6.4 Cross-Site Scripting (XSS) in Data Visualizer (WordPress plugin) Cross-site scripting in Data Visualizer (WordPress plugin) (CVE-2025-13961). Risk of unauthorized operations or information disclosure. CVE-2025-13961
- Medium 6.4 Cross-Site Scripting (XSS) in Divelogs Widget (WordPress plugin) Cross-site scripting in Divelogs Widget (WordPress plugin) (CVE-2025-13962). Risk of unauthorized operations or information disclosure. CVE-2025-13962
- Medium 6.4 Cross-Site Scripting (XSS) in Reviews Sorted (WordPress plugin) Cross-site scripting in Reviews Sorted (WordPress plugin) (CVE-2025-13969). Risk of unauthorized operations or information disclosure. CVE-2025-13969
- Medium 6.4 Cross-Site Scripting (XSS) in FX Currency Converter (WordPress plugin) Cross-site scripting in FX Currency Converter (WordPress plugin) (CVE-2025-13963). Risk of unauthorized operations or information disclosure. CVE-2025-13963
- Medium 6.4 Cross-Site Scripting (XSS) in Zenost Shortcodes (WordPress plugin) Cross-site scripting in Zenost Shortcodes (WordPress plugin) (CVE-2025-13885). Risk of unauthorized operations or information disclosure. Exploitable via button. CVE-2025-13885
- Medium 6.4 Cross-Site Scripting (XSS) in Hide Email Address (WordPress plugin) Cross-site scripting in Hide Email Address (WordPress plugin) (CVE-2025-13884). Risk of unauthorized operations or information disclosure. CVE-2025-13884
- Medium 6.4 Cross-Site Scripting (XSS) in Simple Nivo Slider (WordPress plugin) Cross-site scripting in Simple Nivo Slider (WordPress plugin) (CVE-2025-13889). Risk of unauthorized operations or information disclosure. CVE-2025-13889
- Medium 6.4 Cross-Site Scripting (XSS) in WPGancio (WordPress plugin) Cross-site scripting in WPGancio (WordPress plugin) (CVE-2025-13904). Risk of unauthorized operations or information disclosure. CVE-2025-13904
- Medium 6.4 Cross-Site Scripting (XSS) in WP Flot (WordPress plugin) Cross-site scripting in WP Flot (WordPress plugin) (CVE-2025-13906). Risk of unauthorized operations or information disclosure. CVE-2025-13906
- Medium 6.4 Cross-Site Scripting (XSS) in GPXpress (WordPress plugin) Cross-site scripting in GPXpress (WordPress plugin) (CVE-2025-13960). Risk of unauthorized operations or information disclosure. CVE-2025-13960
- Medium 6.4 Cross-Site Scripting (XSS) in LS Google Map Router (WordPress plugin) Cross-site scripting in LS Google Map Router (WordPress plugin) (CVE-2025-13850). Risk of unauthorized operations or information disclosure. CVE-2025-13850
- Medium 6.4 Cross-Site Scripting (XSS) in BUKAZU Search widget (WordPress plugin) Cross-site scripting in BUKAZU Search widget (WordPress plugin) (CVE-2025-13840). Risk of unauthorized operations or information disclosure. CVE-2025-13840
- Medium 6.4 Cross-Site Scripting (XSS) in NewStatPress (WordPress plugin) Cross-site scripting in NewStatPress (WordPress plugin) (CVE-2025-13747). Risk of unauthorized operations or information disclosure. CVE-2025-13747
- Medium 6.4 Cross-Site Scripting (XSS) in VigLink SpotLight By ShortCode (WordPress plugin) Cross-site scripting in VigLink SpotLight By ShortCode (WordPress plugin) (CVE-2025-13843). Risk of unauthorized operations or information disclosure. CVE-2025-13843
- Medium 6.4 Cross-Site Scripting (XSS) in Easy Map Creator (WordPress plugin) Cross-site scripting in Easy Map Creator (WordPress plugin) (CVE-2025-13846). Risk of unauthorized operations or information disclosure. CVE-2025-13846
- Medium 6.1 Cross-Site Scripting (XSS) in Accept Stripe Payments Using Contact Form (WordPress plugin) Cross-site scripting in Accept Stripe Payments Using Contact Form (WordPress plugin) (CVE-2025-12834). Risk of unauthorized operations or information disclosure. CVE-2025-12834
- Medium 6.4 Cross-Site Scripting (XSS) in Better Elementor Addons (WordPress plugin) Cross-site scripting in Better Elementor Addons (WordPress plugin) (CVE-2025-12830). Risk of unauthorized operations or information disclosure. CVE-2025-12830