slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Medium 4.4 Cross-Site Scripting (XSS) in Just Highlight (WordPress plugin) Cross-site scripting in Just Highlight (WordPress plugin) (CVE-2025-13311). Risk of unauthorized operations or information disclosure. CVE-2025-13311
- Medium 4.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12032). Risk of unauthorized operations or information disclosure. CVE-2025-12032
- Medium 4.4 Cross-Site Scripting (XSS) in YouTube Subscribe (WordPress plugin) Cross-site scripting in YouTube Subscribe (WordPress plugin) (CVE-2025-12025). Risk of unauthorized operations or information disclosure. CVE-2025-12025
- Medium 6.1 Cross-Site Scripting (XSS) in SNC-CX600W all Cross-site scripting in SNC-CX600W all (CVE-2025-64730). Risk of unauthorized operations or information disclosure. CVE-2025-64730
- High 7.2 Cross-Site Scripting (XSS) in Telegram Bot & Channel (WordPress plugin) Cross-site scripting in Telegram Bot & Channel (WordPress plugin) (CVE-2025-13068). Risk of unauthorized operations or information disclosure. CVE-2025-13068
- Medium 6.1 Cross-Site Scripting (XSS) in OpenRapid RapidCMS Cross-site scripting in OpenRapid RapidCMS (CVE-2025-64047). Risk of unauthorized operations or information disclosure. CVE-2025-64047
- Medium 6.1 Cross-Site Scripting (XSS) in YCCMS Cross-site scripting in YCCMS (CVE-2025-64048). Risk of unauthorized operations or information disclosure. CVE-2025-64048
- High 8.7 A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer… Cross-site scripting reported (CVE-2025-10555). Confidential information can be exposed externally. CVE-2025-10555
- High 8.7 Cross-Site Scripting (XSS) in 3Ds Cross-site scripting in 3Ds (CVE-2025-10554). Confidential information can be exposed externally. CVE-2025-10554
- Unrated Cross-Site Scripting (XSS) in SVG Cross-site scripting in SVG (CVE-2025-41087). Risk of unauthorized operations or information disclosure. CVE-2025-41087
- High 7.1 Vulnerability in Broken Link Manager (WordPress plugin) CVE-2025-12629
- High 7.1 Vulnerability in WordPress eCommerce Plugin (WordPress plugin) CVE-2024-14015
- Low 3.5 Cross-Site Scripting (XSS) in Eigenfocus Cross-site scripting in Eigenfocus (CVE-2025-13584). Risk of unauthorized operations or information disclosure. CVE-2025-13584
- Unrated FMS developed by Otsuka Information Technology has a Reflected Cross-site Scripting vulnerability, allowing… Cross-site scripting reported (CVE-2025-13589). Risk of unauthorized operations or information disclosure. CVE-2025-13589
- Low 3.5 Cross-Site Scripting (XSS) in PHPGurukul Hostel Management System Cross-site scripting in PHPGurukul Hostel Management System (CVE-2025-13577). Risk of unauthorized operations or information disclosure. CVE-2025-13577
- Medium 6.4 Cross-Site Scripting (XSS) in Cookie Notice & Compliance for GDPR / CCPA (WordPress plugin) Cross-site scripting in Cookie Notice & Compliance for GDPR / CCPA (WordPress plugin) (CVE-2025-11186). Risk of unauthorized operations or information disclosure. CVE-2025-11186
- Medium 6.5 Cross-Site Scripting (XSS) in Nelio Popups Cross-site scripting in Nelio Popups (CVE-2025-66111). Risk of unauthorized operations or information disclosure. CVE-2025-66111
- Medium 6.5 Cross-Site Scripting (XSS) in Travelers' Map Cross-site scripting in Travelers' Map (CVE-2025-66098). Risk of unauthorized operations or information disclosure. CVE-2025-66098
- Medium 6.5 Cross-Site Scripting (XSS) in Extensions for Leaflet Map Cross-site scripting in Extensions for Leaflet Map (CVE-2025-66093). Risk of unauthorized operations or information disclosure. CVE-2025-66093
- Medium 6.5 Cross-Site Scripting (XSS) in Accordion Slider Cross-site scripting in Accordion Slider (CVE-2025-66092). Risk of unauthorized operations or information disclosure. CVE-2025-66092
- Medium 6.5 Cross-Site Scripting (XSS) in SKT Skill Bar Cross-site scripting in SKT Skill Bar (CVE-2025-66090). Risk of unauthorized operations or information disclosure. CVE-2025-66090
- Medium 6.5 Cross-Site Scripting (XSS) in Stylish Cost Calculator Cross-site scripting in Stylish Cost Calculator (CVE-2025-66091). Risk of unauthorized operations or information disclosure. CVE-2025-66091
- Medium 5.9 Cross-Site Scripting (XSS) in Head Meta Data Cross-site scripting in Head Meta Data (CVE-2025-66081). Risk of unauthorized operations or information disclosure. CVE-2025-66081
- Medium 6.5 Cross-Site Scripting (XSS) in Funnel Builder by FunnelKit Cross-site scripting in Funnel Builder by FunnelKit (CVE-2025-66067). Risk of unauthorized operations or information disclosure. CVE-2025-66067
- Medium 6.5 Cross-Site Scripting (XSS) in Envo Extra Cross-site scripting in Envo Extra (CVE-2025-66066). Risk of unauthorized operations or information disclosure. CVE-2025-66066
- Medium 6.5 Cross-Site Scripting (XSS) in Bold Page Builder Cross-site scripting in Bold Page Builder (CVE-2025-66057). Risk of unauthorized operations or information disclosure. CVE-2025-66057
- Medium 6.5 Cross-Site Scripting (XSS) in Enfold Cross-site scripting in Enfold (CVE-2025-66053). Risk of unauthorized operations or information disclosure. CVE-2025-66053
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12935). Risk of unauthorized operations or information disclosure. CVE-2025-12935
- Medium 6.4 Cross-Site Scripting (XSS) in Magical Products Display (WordPress plugin) Cross-site scripting in Magical Products Display (WordPress plugin) (CVE-2025-12964). Risk of unauthorized operations or information disclosure. CVE-2025-12964
- High 7.2 Cross-Site Scripting (XSS) in Simple User Registration (WordPress plugin) Cross-site scripting in Simple User Registration (WordPress plugin) (CVE-2025-12160). Risk of unauthorized operations or information disclosure. CVE-2025-12160