slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Medium 6.5 Cross-Site Scripting (XSS) in JNews Gallery Cross-site scripting in JNews Gallery (CVE-2025-67538). Risk of unauthorized operations or information disclosure. CVE-2025-67538
- Medium 6.5 Cross-Site Scripting (XSS) in ThirstyAffiliates Cross-site scripting in ThirstyAffiliates (CVE-2025-67537). Risk of unauthorized operations or information disclosure. CVE-2025-67537
- Medium 6.5 Cross-Site Scripting (XSS) in LearnPress Cross-site scripting in LearnPress (CVE-2025-67536). Risk of unauthorized operations or information disclosure. CVE-2025-67536
- High 7.1 Cross-Site Request Forgery (CSRF) in Rencontre Vulnerability in Rencontre (CVE-2025-67534). Risk of unauthorized operations or information disclosure. CVE-2025-67534
- High 7.1 Cross-Site Scripting (XSS) in Themify Portfolio Post Cross-site scripting in Themify Portfolio Post (CVE-2025-67533). Risk of unauthorized operations or information disclosure. CVE-2025-67533
- Medium 6.5 Cross-Site Scripting (XSS) in Cornerstone Cross-site scripting in Cornerstone (CVE-2025-63072). Risk of unauthorized operations or information disclosure. CVE-2025-63072
- Medium 6.5 Cross-Site Scripting (XSS) in The7 Cross-site scripting in The7 (CVE-2025-63073). Risk of unauthorized operations or information disclosure. CVE-2025-63073
- Medium 6.5 Cross-Site Scripting (XSS) in Betheme Cross-site scripting in Betheme (CVE-2025-63075). Risk of unauthorized operations or information disclosure. CVE-2025-63075
- Medium 6.5 Cross-Site Scripting (XSS) in EventON Cross-site scripting in EventON (CVE-2025-63064). Risk of unauthorized operations or information disclosure. CVE-2025-63064
- Medium 6.5 Cross-Site Scripting (XSS) in Porto Theme - Functionality Cross-site scripting in Porto Theme - Functionality (CVE-2025-63066). Risk of unauthorized operations or information disclosure. CVE-2025-63066
- Medium 5.3 Vulnerability in Contact Form 7 – Dynamic Text Extension CVE-2025-63068
- Medium 6.5 Cross-Site Scripting (XSS) in KALLYAS Cross-site scripting in KALLYAS (CVE-2025-63061). Risk of unauthorized operations or information disclosure. CVE-2025-63061
- Medium 6.5 Cross-Site Scripting (XSS) in Wp Ultimate Review Cross-site scripting in Wp Ultimate Review (CVE-2025-63057). Risk of unauthorized operations or information disclosure. CVE-2025-63057
- Medium 6.5 Cross-Site Scripting (XSS) in Ninja Popups Cross-site scripting in Ninja Popups (CVE-2025-63059). Risk of unauthorized operations or information disclosure. CVE-2025-63059
- Medium 6.5 Cross-Site Scripting (XSS) in Master Addons for Elementor Cross-site scripting in Master Addons for Elementor (CVE-2025-63055). Risk of unauthorized operations or information disclosure. CVE-2025-63055
- Medium 6.5 Cross-Site Scripting (XSS) in ListingPro Lead Form Cross-site scripting in ListingPro Lead Form (CVE-2025-63048). Risk of unauthorized operations or information disclosure. CVE-2025-63048
- Medium 6.5 Cross-Site Scripting (XSS) in REHub Framework Cross-site scripting in REHub Framework (CVE-2025-63050). Risk of unauthorized operations or information disclosure. CVE-2025-63050
- Medium 6.5 Cross-Site Scripting (XSS) in SimpLy Gallery Cross-site scripting in SimpLy Gallery (CVE-2025-63052). Risk of unauthorized operations or information disclosure. CVE-2025-63052
- Medium 6.5 Cross-Site Scripting (XSS) in Xpro Elementor Addons Cross-site scripting in Xpro Elementor Addons (CVE-2025-63044). Risk of unauthorized operations or information disclosure. CVE-2025-63044
- Medium 6.5 Cross-Site Scripting (XSS) in Master Slider Pro Cross-site scripting in Master Slider Pro (CVE-2025-63045). Risk of unauthorized operations or information disclosure. CVE-2025-63045
- Medium 6.5 Cross-Site Scripting (XSS) in WPLMS Cross-site scripting in WPLMS (CVE-2025-63035). Risk of unauthorized operations or information disclosure. CVE-2025-63035
- Medium 6.5 Cross-Site Scripting (XSS) in Ronneby Theme Core Cross-site scripting in Ronneby Theme Core (CVE-2025-63037). Risk of unauthorized operations or information disclosure. CVE-2025-63037
- Medium 6.5 Cross-Site Scripting (XSS) in Tutor LMS Elementor Addons Cross-site scripting in Tutor LMS Elementor Addons (CVE-2025-63042). Risk of unauthorized operations or information disclosure. CVE-2025-63042
- Medium 6.5 Cross-Site Scripting (XSS) in ListingPro Cross-site scripting in ListingPro (CVE-2025-63046). Risk of unauthorized operations or information disclosure. CVE-2025-63046
- Medium 5.9 Cross-Site Scripting (XSS) in Make Section & Column Clickable For Elementor Cross-site scripting in Make Section & Column Clickable For Elementor (CVE-2025-63033). Risk of unauthorized operations or information disclosure. CVE-2025-63033
- Medium 5.9 Cross-Site Scripting (XSS) in WP Hotel Booking Cross-site scripting in WP Hotel Booking (CVE-2025-63011). Risk of unauthorized operations or information disclosure. CVE-2025-63011
- Medium 6.5 Cross-Site Scripting (XSS) in Generic Elements Cross-site scripting in Generic Elements (CVE-2025-62082). Risk of unauthorized operations or information disclosure. CVE-2025-62082
- Medium 4.6 Cross-Site Scripting (XSS) in Adata Cross-site scripting in Adata (CVE-2025-61074). Risk of unauthorized operations or information disclosure. CVE-2025-61074
- High 7.1 Cross-Site Request Forgery (CSRF) in Create Posts & Terms Vulnerability in Create Posts & Terms (CVE-2025-49351). Risk of unauthorized operations or information disclosure. CVE-2025-49351
- High 7.1 Cross-Site Request Forgery (CSRF) in WP sIFR Vulnerability in WP sIFR (CVE-2025-49347). Risk of unauthorized operations or information disclosure. CVE-2025-49347