slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,604
- Medium 6.5 Cross-Site Scripting (XSS) in NextMove Lite Cross-site scripting in NextMove Lite (CVE-2025-62969). Risk of unauthorized operations or information disclosure. CVE-2025-62969
- Medium 6.5 Cross-Site Scripting (XSS) in WP Last Modified Info Cross-site scripting in WP Last Modified Info (CVE-2025-62968). Risk of unauthorized operations or information disclosure. CVE-2025-62968
- Medium 6.5 Cross-Site Scripting (XSS) in DirectoryPress Cross-site scripting in DirectoryPress (CVE-2025-62967). Risk of unauthorized operations or information disclosure. CVE-2025-62967
- High 7.1 Cross-Site Request Forgery (CSRF) in NikanWP WooCommerce Reporting Vulnerability in NikanWP WooCommerce Reporting (CVE-2025-62957). Risk of unauthorized operations or information disclosure. CVE-2025-62957
- High 7.1 Cross-Site Request Forgery (CSRF) in CloudSearch Vulnerability in CloudSearch (CVE-2025-62962). Risk of unauthorized operations or information disclosure. CVE-2025-62962
- High 7.1 Cross-Site Request Forgery (CSRF) in Reloadly Vulnerability in Reloadly (CVE-2025-62956). Risk of unauthorized operations or information disclosure. CVE-2025-62956
- Medium 6.5 Cross-Site Scripting (XSS) in Activity Plus Reloaded for BuddyPress Cross-site scripting in Activity Plus Reloaded for BuddyPress (CVE-2025-62949). Risk of unauthorized operations or information disclosure. CVE-2025-62949
- Medium 6.5 Cross-Site Scripting (XSS) in Date counter Cross-site scripting in Date counter (CVE-2025-62948). Risk of unauthorized operations or information disclosure. CVE-2025-62948
- Medium 6.5 Cross-Site Scripting (XSS) in H5P Cross-site scripting in H5P (CVE-2025-62951). Risk of unauthorized operations or information disclosure. CVE-2025-62951
- Medium 6.5 Cross-Site Scripting (XSS) in Blox Lite Cross-site scripting in Blox Lite (CVE-2025-62940). Risk of unauthorized operations or information disclosure. CVE-2025-62940
- High 7.1 Cross-Site Request Forgery (CSRF) in Did Prestashop Display Vulnerability in Did Prestashop Display (CVE-2025-62945). Risk of unauthorized operations or information disclosure. CVE-2025-62945
- Medium 6.5 Cross-Site Scripting (XSS) in Next Page, Not Next Post Cross-site scripting in Next Page, Not Next Post (CVE-2025-62943). Risk of unauthorized operations or information disclosure. CVE-2025-62943
- Medium 6.5 Cross-Site Scripting (XSS) in WP Mapbox GL JS Maps Cross-site scripting in WP Mapbox GL JS Maps (CVE-2025-62942). Risk of unauthorized operations or information disclosure. CVE-2025-62942
- High 7.1 Cross-Site Request Forgery (CSRF) in Awesome Testimonials Vulnerability in Awesome Testimonials (CVE-2025-62933). Risk of unauthorized operations or information disclosure. CVE-2025-62933
- Medium 4.3 Vulnerability in xSmart CVE-2025-62936
- High 7.1 Cross-Site Request Forgery (CSRF) in WP Business Hours Vulnerability in WP Business Hours (CVE-2025-62934). Risk of unauthorized operations or information disclosure. CVE-2025-62934
- Medium 6.5 Cross-Site Scripting (XSS) in Open Currency Converter Cross-site scripting in Open Currency Converter (CVE-2025-62939). Risk of unauthorized operations or information disclosure. CVE-2025-62939
- Medium 6.5 Cross-Site Scripting (XSS) in Post List Featured Image Cross-site scripting in Post List Featured Image (CVE-2025-62937). Risk of unauthorized operations or information disclosure. CVE-2025-62937
- Medium 6.5 Cross-Site Scripting (XSS) in MapSVG Cross-site scripting in MapSVG (CVE-2025-62930). Risk of unauthorized operations or information disclosure. CVE-2025-62930
- Medium 6.5 Cross-Site Scripting (XSS) in Tooltipy Cross-site scripting in Tooltipy (CVE-2025-62917). Risk of unauthorized operations or information disclosure. CVE-2025-62917
- Medium 5.9 Cross-Site Scripting (XSS) in USERCENTRICS CMP Cross-site scripting in USERCENTRICS CMP (CVE-2025-62920). Risk of unauthorized operations or information disclosure. CVE-2025-62920
- Medium 6.5 Cross-Site Scripting (XSS) in Bulk Auto Image Title Attribute Cross-site scripting in Bulk Auto Image Title Attribute (CVE-2025-62921). Risk of unauthorized operations or information disclosure. CVE-2025-62921
- Medium 6.5 Cross-Site Scripting (XSS) in Marquee Addons for Elementor Cross-site scripting in Marquee Addons for Elementor (CVE-2025-62923). Risk of unauthorized operations or information disclosure. CVE-2025-62923
- Medium 6.5 Cross-Site Scripting (XSS) in SiteGround Email Marketing Cross-site scripting in SiteGround Email Marketing (CVE-2025-62912). Risk of unauthorized operations or information disclosure. CVE-2025-62912
- Medium 6.5 Cross-Site Scripting (XSS) in Rock Convert Cross-site scripting in Rock Convert (CVE-2025-62911). Risk of unauthorized operations or information disclosure. CVE-2025-62911
- Medium 6.5 Cross-Site Scripting (XSS) in Video Gallery by Huzzaz Cross-site scripting in Video Gallery by Huzzaz (CVE-2025-62910). Risk of unauthorized operations or information disclosure. CVE-2025-62910
- Medium 6.5 Cross-Site Scripting (XSS) in Opal Service Cross-site scripting in Opal Service (CVE-2025-62913). Risk of unauthorized operations or information disclosure. CVE-2025-62913
- Medium 6.5 Cross-Site Scripting (XSS) in Custom Post Type Attachment Cross-site scripting in Custom Post Type Attachment (CVE-2025-62907). Risk of unauthorized operations or information disclosure. CVE-2025-62907
- Medium 5.9 Cross-Site Scripting (XSS) in Photospace Responsive Cross-site scripting in Photospace Responsive (CVE-2025-62899). Risk of unauthorized operations or information disclosure. CVE-2025-62899
- Medium 6.5 Cross-Site Scripting (XSS) in Popular Posts by Webline Cross-site scripting in Popular Posts by Webline (CVE-2025-62900). Risk of unauthorized operations or information disclosure. CVE-2025-62900