slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Medium 4.4 Cross-Site Scripting (XSS) in WP Delete Post Copies (WordPress plugin) Cross-site scripting in WP Delete Post Copies (WordPress plugin) (CVE-2025-12066). Risk of unauthorized operations or information disclosure. CVE-2025-12066
- Medium 6.4 Cross-Site Scripting (XSS) in HT Mega – Absolute Addons For Elementor (WordPress plugin) Cross-site scripting in HT Mega – Absolute Addons For Elementor (WordPress plugin) (CVE-2025-13141). Risk of unauthorized operations or information disclosure. CVE-2025-13141
- Medium 6.4 Cross-Site Scripting (XSS) in WP Company Info (WordPress plugin) Cross-site scripting in WP Company Info (WordPress plugin) (CVE-2025-11826). Risk of unauthorized operations or information disclosure. CVE-2025-11826
- Medium 6.4 Cross-Site Scripting (XSS) in Shortcode for Google Street View (WordPress plugin) Cross-site scripting in Shortcode for Google Street View (WordPress plugin) (CVE-2025-11808). Risk of unauthorized operations or information disclosure. CVE-2025-11808
- Medium 6.4 Cross-Site Scripting (XSS) in WPSite Shortcode (WordPress plugin) Cross-site scripting in WPSite Shortcode (WordPress plugin) (CVE-2025-11803). Risk of unauthorized operations or information disclosure. CVE-2025-11803
- High 7.1 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13159). Risk of unauthorized operations or information disclosure. Exploitable via flo_form_submit. CVE-2025-13159
- Medium 6.4 Cross-Site Scripting (XSS) in HotelRunner Booking Widget (WordPress plugin) Cross-site scripting in HotelRunner Booking Widget (WordPress plugin) (CVE-2025-13135). Risk of unauthorized operations or information disclosure. CVE-2025-13135
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12661). Risk of unauthorized operations or information disclosure. CVE-2025-12661
- Medium 6.4 Cross-Site Scripting (XSS) in Padlet Shortcode (WordPress plugin) Cross-site scripting in Padlet Shortcode (WordPress plugin) (CVE-2025-12660). Risk of unauthorized operations or information disclosure. CVE-2025-12660
- High 7.2 Cross-Site Scripting (XSS) in WPBookit (WordPress plugin) Cross-site scripting in WPBookit (WordPress plugin) (CVE-2025-12135). Risk of unauthorized operations or information disclosure. CVE-2025-12135
- Medium 6.4 Cross-Site Scripting (XSS) in Bulma Shortcodes (WordPress plugin) Cross-site scripting in Bulma Shortcodes (WordPress plugin) (CVE-2025-11802). Risk of unauthorized operations or information disclosure. CVE-2025-11802
- Medium 6.4 Cross-Site Scripting (XSS) in AudioTube (WordPress plugin) Cross-site scripting in AudioTube (WordPress plugin) (CVE-2025-11801). Risk of unauthorized operations or information disclosure. CVE-2025-11801
- Medium 6.4 Cross-Site Scripting (XSS) in Surbma | MiniCRM Shortcode (WordPress plugin) Cross-site scripting in Surbma | MiniCRM Shortcode (WordPress plugin) (CVE-2025-11800). Risk of unauthorized operations or information disclosure. CVE-2025-11800
- Medium 6.1 Cross-Site Scripting (XSS) in EchBay Admin Security (WordPress plugin) Cross-site scripting in EchBay Admin Security (WordPress plugin) (CVE-2025-11885). Risk of unauthorized operations or information disclosure. CVE-2025-11885
- Medium 6.4 Cross-Site Scripting (XSS) in Affiliate AI Lite (WordPress plugin) Cross-site scripting in Affiliate AI Lite (WordPress plugin) (CVE-2025-11799). Risk of unauthorized operations or information disclosure. CVE-2025-11799
- Medium 6.4 Cross-Site Scripting (XSS) in BrightTALK WordPress Shortcode (WordPress plugin) Cross-site scripting in BrightTALK WordPress Shortcode (WordPress plugin) (CVE-2025-11770). Risk of unauthorized operations or information disclosure. CVE-2025-11770
- Medium 6.4 Cross-Site Scripting (XSS) in Islamic Phrases (WordPress plugin) Cross-site scripting in Islamic Phrases (WordPress plugin) (CVE-2025-11768). Risk of unauthorized operations or information disclosure. CVE-2025-11768
- Medium 6.4 Cross-Site Scripting (XSS) in Tips Shortcode (WordPress plugin) Cross-site scripting in Tips Shortcode (WordPress plugin) (CVE-2025-11767). Risk of unauthorized operations or information disclosure. CVE-2025-11767
- Medium 6.4 Cross-Site Scripting (XSS) in Stock Tools (WordPress plugin) Cross-site scripting in Stock Tools (WordPress plugin) (CVE-2025-11765). Risk of unauthorized operations or information disclosure. CVE-2025-11765
- Medium 6.4 Cross-Site Scripting (XSS) in Shortcodes Bootstrap (WordPress plugin) Cross-site scripting in Shortcodes Bootstrap (WordPress plugin) (CVE-2025-11764). Risk of unauthorized operations or information disclosure. CVE-2025-11764
- Medium 6.4 Cross-Site Scripting (XSS) in Display Pages Shortcode (WordPress plugin) Cross-site scripting in Display Pages Shortcode (WordPress plugin) (CVE-2025-11763). Risk of unauthorized operations or information disclosure. CVE-2025-11763
- Medium 6.1 Cross-Site Scripting (XSS) in Tainacan (WordPress plugin) Cross-site scripting in Tainacan (WordPress plugin) (CVE-2025-12746). Risk of unauthorized operations or information disclosure. CVE-2025-12746
- Medium 5.4 Cross-Site Scripting (XSS) in Linux Windows Cross-site scripting in Linux Windows (CVE-2025-61949). Risk of unauthorized operations or information disclosure. CVE-2025-61949
- Low 2.4 Cross-Site Scripting (XSS) in Campcodes Complete Online Beauty Parlor Management System Cross-site scripting in Campcodes Complete Online Beauty Parlor Management System (CVE-2025-13484). Risk of unauthorized operations or information disclosure. CVE-2025-13484
- Medium 6.1 Cross-Site Scripting (XSS) in IBM Concert Cross-site scripting in IBM Concert (CVE-2025-36153). Risk of unauthorized operations or information disclosure. CVE-2025-36153
- Medium 5.4 Cross-Site Scripting (XSS) in Revive Adserver Cross-site scripting in Revive Adserver (CVE-2025-55123). Risk of unauthorized operations or information disclosure. CVE-2025-55123
- Medium 6.1 Cross-Site Scripting (XSS) in Revive Adserver Cross-site scripting in Revive Adserver (CVE-2025-55124). Risk of unauthorized operations or information disclosure. CVE-2025-55124
- Low 3.5 Cross-Site Scripting (XSS) in Medical Informatics Engineering Enterprise Health Cross-site scripting in Medical Informatics Engineering Enterprise Health (CVE-2025-35029). Risk of unauthorized operations or information disclosure. CVE-2025-35029
- Medium 6.1 Cross-Site Scripting (XSS) in Revive Adserver Cross-site scripting in Revive Adserver (CVE-2025-48987). Risk of unauthorized operations or information disclosure. CVE-2025-48987
- Medium 5.4 Cross-Site Scripting (XSS) in Revive Adserver Cross-site scripting in Revive Adserver (CVE-2025-52667). Risk of unauthorized operations or information disclosure. CVE-2025-52667