slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,602
- Medium 6.5 Cross-Site Scripting (XSS) in TheGem Cross-site scripting in TheGem (CVE-2025-62011). Risk of unauthorized operations or information disclosure. CVE-2025-62011
- High 7.1 Vulnerability in TableOn CVE-2025-60244
- High 7.1 Cross-Site Scripting (XSS) in GoStore Cross-site scripting in GoStore (CVE-2025-59556). Risk of unauthorized operations or information disclosure. CVE-2025-59556
- High 7.1 Cross-Site Scripting (XSS) in Institutions Directory Cross-site scripting in Institutions Directory (CVE-2025-58638). Risk of unauthorized operations or information disclosure. CVE-2025-58638
- High 7.1 Cross-Site Scripting (XSS) in Enzy Cross-site scripting in Enzy (CVE-2025-58964). Risk of unauthorized operations or information disclosure. CVE-2025-58964
- High 7.1 Cross-Site Scripting (XSS) in Jobmonster Cross-site scripting in Jobmonster (CVE-2025-54737). Risk of unauthorized operations or information disclosure. CVE-2025-54737
- High 7.1 Cross-Site Scripting (XSS) in WooTour Cross-site scripting in WooTour (CVE-2025-54722). Risk of unauthorized operations or information disclosure. CVE-2025-54722
- High 7.1 Cross-Site Scripting (XSS) in Resca Cross-site scripting in Resca (CVE-2025-54721). Risk of unauthorized operations or information disclosure. CVE-2025-54721
- High 7.1 Cross-Site Scripting (XSS) in Yogi - Health Beauty & Yoga Cross-site scripting in Yogi - Health Beauty & Yoga (CVE-2025-54718). Risk of unauthorized operations or information disclosure. CVE-2025-54718
- High 7.1 Cross-Site Scripting (XSS) in WeMusic Cross-site scripting in WeMusic (CVE-2025-53585). Risk of unauthorized operations or information disclosure. CVE-2025-53585
- High 7.1 Cross-Site Scripting (XSS) in Doliconnect Cross-site scripting in Doliconnect (CVE-2025-53574). Risk of unauthorized operations or information disclosure. CVE-2025-53574
- High 7.1 Cross-Site Scripting (XSS) in Dropify Cross-site scripting in Dropify (CVE-2025-53286). Risk of unauthorized operations or information disclosure. CVE-2025-53286
- High 7.1 Cross-Site Request Forgery (CSRF) in WP GDPR Cookie Consent Vulnerability in WP GDPR Cookie Consent (CVE-2025-53316). Risk of unauthorized operations or information disclosure. CVE-2025-53316
- High 7.1 Cross-Site Scripting (XSS) in Gutenify Cross-site scripting in Gutenify (CVE-2025-53324). Risk of unauthorized operations or information disclosure. CVE-2025-53324
- High 7.1 Cross-Site Scripting (XSS) in Kalium Cross-site scripting in Kalium (CVE-2025-53349). Risk of unauthorized operations or information disclosure. CVE-2025-53349
- High 7.1 Cross-Site Scripting (XSS) in Epic Review Cross-site scripting in Epic Review (CVE-2025-53573). Risk of unauthorized operations or information disclosure. CVE-2025-53573
- High 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bnovotny User… Cross-site scripting reported (CVE-2025-53239). Risk of unauthorized operations or information disclosure. CVE-2025-53239
- High 7.1 Cross-Site Scripting (XSS) in WP Logo Changer Cross-site scripting in WP Logo Changer (CVE-2025-53245). Risk of unauthorized operations or information disclosure. CVE-2025-53245
- High 7.1 Cross-Site Scripting (XSS) in Range Slider Addon for Gravity Forms Cross-site scripting in Range Slider Addon for Gravity Forms (CVE-2025-49905). Risk of unauthorized operations or information disclosure. CVE-2025-49905
- High 7.1 Cross-Site Scripting (XSS) in Booking and Rental Manager Cross-site scripting in Booking and Rental Manager (CVE-2025-49904). Risk of unauthorized operations or information disclosure. CVE-2025-49904
- High 7.1 Cross-Site Scripting (XSS) in flexoslider Cross-site scripting in flexoslider (CVE-2025-52764). Risk of unauthorized operations or information disclosure. CVE-2025-52764
- High 7.1 Cross-Site Scripting (XSS) in Penci Bookmark & Follow Cross-site scripting in Penci Bookmark & Follow (CVE-2025-49909). Risk of unauthorized operations or information disclosure. CVE-2025-49909
- High 7.1 Cross-Site Scripting (XSS) in Cookie Notice & Consent Cross-site scripting in Cookie Notice & Consent (CVE-2025-49390). Risk of unauthorized operations or information disclosure. CVE-2025-49390
- Medium 6.5 Vulnerability in Easy Appointments CVE-2025-49398
- High 7.1 Cross-Site Request Forgery (CSRF) in Block Country Vulnerability in Block Country (CVE-2025-48077). Risk of unauthorized operations or information disclosure. CVE-2025-48077
- High 7.1 Cross-Site Request Forgery (CSRF) in Slick Google Map Vulnerability in Slick Google Map (CVE-2025-48078). Risk of unauthorized operations or information disclosure. CVE-2025-48078
- High 7.1 Cross-Site Request Forgery (CSRF) in wpNamedUsers Vulnerability in wpNamedUsers (CVE-2025-48083). Risk of unauthorized operations or information disclosure. CVE-2025-48083
- High 7.1 Cross-Site Request Forgery (CSRF) in Simple Stripe Vulnerability in Simple Stripe (CVE-2025-48085). Risk of unauthorized operations or information disclosure. CVE-2025-48085
- High 7.1 Cross-Site Scripting (XSS) in replyMail Cross-site scripting in replyMail (CVE-2025-31029). Risk of unauthorized operations or information disclosure. CVE-2025-31029
- High 8.9 Cross-Site Scripting (XSS) in OBS Cross-site scripting in OBS (CVE-2025-11956). Confidential information can be exposed externally. CVE-2025-11956