slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Medium 4.9 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12020). Risk of unauthorized operations or information disclosure. CVE-2025-12020
- Medium 6.4 Cross-Site Scripting (XSS) in Simple Donate (WordPress plugin) Cross-site scripting in Simple Donate (WordPress plugin) (CVE-2025-11882). Risk of unauthorized operations or information disclosure. CVE-2025-11882
- Medium 5.4 Vulnerability in Slippy Slider – Responsive Touch Navigation Slider (WordPress plugin) CVE-2025-11874
- Medium 6.4 Cross-Site Scripting (XSS) in Paypal Donation Shortcode (WordPress plugin) Cross-site scripting in Paypal Donation Shortcode (WordPress plugin) (CVE-2025-11859). Risk of unauthorized operations or information disclosure. CVE-2025-11859
- Medium 6.4 Cross-Site Scripting (XSS) in Twitter Feed (WordPress plugin) Cross-site scripting in Twitter Feed (WordPress plugin) (CVE-2025-11860). Risk of unauthorized operations or information disclosure. CVE-2025-11860
- Medium 6.4 Cross-Site Scripting (XSS) in Precise Columns (WordPress plugin) Cross-site scripting in Precise Columns (WordPress plugin) (CVE-2025-11869). Risk of unauthorized operations or information disclosure. Exploitable via wrap_id. CVE-2025-11869
- Medium 6.4 Cross-Site Scripting (XSS) in My Geo Posts Free (WordPress plugin) Cross-site scripting in My Geo Posts Free (WordPress plugin) (CVE-2025-11863). Risk of unauthorized operations or information disclosure. CVE-2025-11863
- Medium 6.4 Cross-Site Scripting (XSS) in WP BBCode (WordPress plugin) Cross-site scripting in WP BBCode (WordPress plugin) (CVE-2025-11873). Risk of unauthorized operations or information disclosure. CVE-2025-11873
- Medium 6.4 Cross-Site Scripting (XSS) in Five9 Live Chat (WordPress plugin) Cross-site scripting in Five9 Live Chat (WordPress plugin) (CVE-2025-11829). Risk of unauthorized operations or information disclosure. CVE-2025-11829
- Medium 6.4 Cross-Site Scripting (XSS) in Skip to Timestamp (WordPress plugin) Cross-site scripting in Skip to Timestamp (WordPress plugin) (CVE-2025-11805). Risk of unauthorized operations or information disclosure. CVE-2025-11805
- Medium 6.4 Cross-Site Scripting (XSS) in Magazine Companion (WordPress plugin) Cross-site scripting in Magazine Companion (WordPress plugin) (CVE-2025-11828). Risk of unauthorized operations or information disclosure. CVE-2025-11828
- Medium 6.4 Cross-Site Scripting (XSS) in Woocommerce – Products By Custom Tax (WordPress plugin) Cross-site scripting in Woocommerce – Products By Custom Tax (WordPress plugin) (CVE-2025-11821). Risk of unauthorized operations or information disclosure. CVE-2025-11821
- Medium 6.4 Cross-Site Scripting (XSS) in WP Bootstrap Tabs (WordPress plugin) Cross-site scripting in WP Bootstrap Tabs (WordPress plugin) (CVE-2025-11822). Risk of unauthorized operations or information disclosure. CVE-2025-11822
- Medium 6.4 Cross-Site Scripting (XSS) in Eventbee Ticketing Widget (WordPress plugin) Cross-site scripting in Eventbee Ticketing Widget (WordPress plugin) (CVE-2025-11856). Risk of unauthorized operations or information disclosure. CVE-2025-11856
- Medium 6.4 Cross-Site Scripting (XSS) in Include Fussball.de Widgets (WordPress plugin) Cross-site scripting in Include Fussball.de Widgets (WordPress plugin) (CVE-2025-11129). Risk of unauthorized operations or information disclosure. CVE-2025-11129
- Medium 6.1 Cross-Site Scripting (XSS) in SAP Business Connector Cross-site scripting in SAP Business Connector (CVE-2025-42886). Risk of unauthorized operations or information disclosure. CVE-2025-42886
- Critical 9.6 Cross-Site Scripting (XSS) in Github Cross-site scripting in Github (CVE-2025-11892). Successful exploitation can lead to full system takeover. CVE-2025-11892
- High 7.6 Cross-Site Scripting (XSS) in ProsemirrorToHtml Cross-site scripting in ProsemirrorToHtml (CVE-2025-64501). Confidential information can be exposed externally. Exploitable via prosemirror_to_html. CVE-2025-64501
- High 8.8 Cross-Site Scripting (XSS) in Combodo Cross-site scripting in Combodo (CVE-2025-48065). Successful exploitation can lead to full system takeover. CVE-2025-48065
- High 8.5 Cross-Site Scripting (XSS) in Combodo Cross-site scripting in Combodo (CVE-2025-48055). Confidential information can be exposed externally. CVE-2025-48055
- High 8.8 Cross-Site Scripting (XSS) in Combodo Cross-site scripting in Combodo (CVE-2025-47932). Successful exploitation can lead to full system takeover. CVE-2025-47932
- High 8.8 Cross-Site Scripting (XSS) in Combodo Cross-site scripting in Combodo (CVE-2025-47773). Successful exploitation can lead to full system takeover. CVE-2025-47773
- Medium 5.4 Cross-Site Scripting (XSS) in Soplanning Cross-site scripting in Soplanning (CVE-2025-41001). Risk of unauthorized operations or information disclosure. CVE-2025-41001
- Medium 5.4 Cross-Site Scripting (XSS) in Smart School Cross-site scripting in Smart School (CVE-2025-41107). Risk of unauthorized operations or information disclosure. CVE-2025-41107
- Low 2.4 Cross-Site Scripting (XSS) in qianfox FoxCMS Cross-site scripting in qianfox FoxCMS (CVE-2025-12920). Risk of unauthorized operations or information disclosure. CVE-2025-12920
- Medium 6.4 Cross-Site Scripting (XSS) in aThemes Addons for Elementor (WordPress plugin) Cross-site scripting in aThemes Addons for Elementor (WordPress plugin) (CVE-2025-12837). Risk of unauthorized operations or information disclosure. CVE-2025-12837
- Medium 6.4 Cross-Site Scripting (XSS) in Saphali LiqPay for donate (WordPress plugin) Cross-site scripting in Saphali LiqPay for donate (WordPress plugin) (CVE-2025-12643). Risk of unauthorized operations or information disclosure. CVE-2025-12643
- Medium 6.1 Cross-Site Scripting (XSS) in Mang Board WP (WordPress plugin) Cross-site scripting in Mang Board WP (WordPress plugin) (CVE-2025-12193). Risk of unauthorized operations or information disclosure. CVE-2025-12193
- Medium 6.1 Cross-Site Scripting (XSS) in WP2Social Auto Publish (WordPress plugin) Cross-site scripting in WP2Social Auto Publish (WordPress plugin) (CVE-2025-12064). Risk of unauthorized operations or information disclosure. CVE-2025-12064
- Medium 6.4 Cross-Site Scripting (XSS) in Insert Headers and Footers Code – HT Script (WordPress plugin) Cross-site scripting in Insert Headers and Footers Code – HT Script (WordPress plugin) (CVE-2025-12112). Risk of unauthorized operations or information disclosure. CVE-2025-12112