slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Low 3.5 Cross-Site Scripting (XSS) in SourceCodester Student Grades Management System Cross-site scripting in SourceCodester Student Grades Management System (CVE-2025-13349). Risk of unauthorized operations or information disclosure. CVE-2025-13349
- Medium 5.4 Cross-Site Scripting (XSS) in Iest Cross-site scripting in Iest (CVE-2025-41350). Risk of unauthorized operations or information disclosure. CVE-2025-41350
- Medium 5.4 Cross-Site Scripting (XSS) in Iest Cross-site scripting in Iest (CVE-2025-41349). Risk of unauthorized operations or information disclosure. CVE-2025-41349
- Low 3.5 Cross-Site Scripting (XSS) in SourceCodester Interview Management System Cross-site scripting in SourceCodester Interview Management System (CVE-2025-13343). Risk of unauthorized operations or information disclosure. CVE-2025-13343
- High 7.2 Cross-Site Scripting (XSS) in Checkout Files Upload for WooCommerce (WordPress plugin) Cross-site scripting in Checkout Files Upload for WooCommerce (WordPress plugin) (CVE-2025-4212). Risk of unauthorized operations or information disclosure. CVE-2025-4212
- Medium 5.4 Cross-Site Scripting (XSS) in Element Pack Addons for Elementor (WordPress plugin) Cross-site scripting in Element Pack Addons for Elementor (WordPress plugin) (CVE-2025-13196). Risk of unauthorized operations or information disclosure. CVE-2025-13196
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12691). Risk of unauthorized operations or information disclosure. CVE-2025-12691
- Medium 6.4 Cross-Site Scripting (XSS) in Enable SVG, WebP, and ICO Upload (WordPress plugin) Cross-site scripting in Enable SVG, WebP, and ICO Upload (WordPress plugin) (CVE-2025-12457). Risk of unauthorized operations or information disclosure. CVE-2025-12457
- Medium 6.4 Cross-Site Scripting (XSS) in Meta Display Block (WordPress plugin) Cross-site scripting in Meta Display Block (WordPress plugin) (CVE-2025-12088). Risk of unauthorized operations or information disclosure. CVE-2025-12088
- Medium 6.1 Cross-Site Scripting (XSS) in WP Twitter Auto Publish (WordPress plugin) Cross-site scripting in WP Twitter Auto Publish (WordPress plugin) (CVE-2025-12079). Risk of unauthorized operations or information disclosure. CVE-2025-12079
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-8605). Risk of unauthorized operations or information disclosure. CVE-2025-8605
- Medium 6.4 Cross-Site Scripting (XSS) in RTMKit Addons for Elementor (WordPress plugin) Cross-site scripting in RTMKit Addons for Elementor (WordPress plugin) (CVE-2025-8609). Risk of unauthorized operations or information disclosure. CVE-2025-8609
- Medium 5.4 Cross-Site Scripting (XSS) in Solarwinds Observability Self Hosted Cross-site scripting in Solarwinds Observability Self Hosted (CVE-2025-26391). Risk of unauthorized operations or information disclosure. CVE-2025-26391
- Medium 6.4 Cross-Site Scripting (XSS) in CSV to SortTable (WordPress plugin) Cross-site scripting in CSV to SortTable (WordPress plugin) (CVE-2025-12823). Risk of unauthorized operations or information disclosure. CVE-2025-12823
- Medium 6.4 Cross-Site Scripting (XSS) in everviz (WordPress plugin) Cross-site scripting in everviz (WordPress plugin) (CVE-2025-11868). Risk of unauthorized operations or information disclosure. Exploitable via everviz. CVE-2025-11868
- Medium 6.1 Cross-Site Scripting (XSS) in ArtiBot Free Chat Bot for WebSites (WordPress plugin) Cross-site scripting in ArtiBot Free Chat Bot for WebSites (WordPress plugin) (CVE-2025-12078). Risk of unauthorized operations or information disclosure. CVE-2025-12078
- Medium 6.4 Vulnerability in WordPress CVE-2025-11267
- Medium 6.4 Vulnerability in WordPress CVE-2025-11265
- Medium 4.8 Cross-Site Scripting (XSS) in Maxum Cross-site scripting in Maxum (CVE-2025-55056). Risk of unauthorized operations or information disclosure. CVE-2025-55056
- Medium 4.8 Cross-Site Scripting (XSS) in Maxum Cross-site scripting in Maxum (CVE-2025-55059). Risk of unauthorized operations or information disclosure. CVE-2025-55059
- Medium 6.1 Cross-Site Scripting (XSS) in OpenRapid RapidCMS Cross-site scripting in OpenRapid RapidCMS (CVE-2025-64046). Risk of unauthorized operations or information disclosure. CVE-2025-64046
- Medium 5.7 Cross-Site Scripting (XSS) in Mendix RichText Cross-site scripting in Mendix RichText (CVE-2025-40834). Confidential information can be exposed externally. CVE-2025-40834
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Student Information System Cross-site scripting in code-projects Student Information System (CVE-2025-13244). Risk of unauthorized operations or information disclosure. CVE-2025-13244
- Low 3.5 Cross-Site Scripting (XSS) in code-projects Student Information System Cross-site scripting in code-projects Student Information System (CVE-2025-13245). Risk of unauthorized operations or information disclosure. CVE-2025-13245
- Low 3.5 Cross-Site Scripting (XSS) in code-projects Simple Cafe Ordering System Cross-site scripting in code-projects Simple Cafe Ordering System (CVE-2025-13202). Risk of unauthorized operations or information disclosure. CVE-2025-13202
- Medium 6.9 The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper… Vulnerability reported (CVE-2025-8386). Confidential information can be exposed externally. CVE-2025-8386
- Low 2.4 Cross-Site Scripting (XSS) in Bdtask Cross-site scripting in Bdtask (CVE-2025-13186). Risk of unauthorized operations or information disclosure. CVE-2025-13186
- Low 3.5 Cross-Site Scripting (XSS) in pojoin h3blog Cross-site scripting in pojoin h3blog (CVE-2025-13182). Risk of unauthorized operations or information disclosure. CVE-2025-13182
- Low 3.5 Vulnerability in Bdtask CVE-2025-13180
- Low 3.5 Cross-Site Scripting (XSS) in pojoin h3blog Cross-site scripting in pojoin h3blog (CVE-2025-13181). Risk of unauthorized operations or information disclosure. CVE-2025-13181