slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8952
SQL Injection4127
Remote Code Execution3108
Path Traversal2163
Privilege Escalation1605
Cross-Site Request Forgery1123
Server-Side Request Forgery895
Authentication Bypass888
Insecure Deserialization809
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,604
- High 7.1 Cross-Site Scripting (XSS) in Slide Puzzle Cross-site scripting in Slide Puzzle (CVE-2025-52751). Risk of unauthorized operations or information disclosure. CVE-2025-52751
- High 7.1 Cross-Site Scripting (XSS) in CropRefine Cross-site scripting in CropRefine (CVE-2025-52734). Risk of unauthorized operations or information disclosure. CVE-2025-52734
- High 7.1 Cross-Site Scripting (XSS) in LearnPress Export Import Cross-site scripting in LearnPress Export Import (CVE-2025-49992). Risk of unauthorized operations or information disclosure. CVE-2025-49992
- High 7.1 Cross-Site Scripting (XSS) in bbPress Notify Cross-site scripting in bbPress Notify (CVE-2025-49962). Risk of unauthorized operations or information disclosure. CVE-2025-49962
- High 7.1 Cross-Site Scripting (XSS) in Finale Lite Cross-site scripting in Finale Lite (CVE-2025-52736). Risk of unauthorized operations or information disclosure. CVE-2025-52736
- High 7.1 Cross-Site Scripting (XSS) in NextMove Lite Cross-site scripting in NextMove Lite (CVE-2025-52735). Risk of unauthorized operations or information disclosure. CVE-2025-52735
- High 7.1 Cross-Site Scripting (XSS) in Simple Stripe Checkout Cross-site scripting in Simple Stripe Checkout (CVE-2025-49963). Risk of unauthorized operations or information disclosure. CVE-2025-49963
- High 7.1 Cross-Site Scripting (XSS) in Fade Slider Cross-site scripting in Fade Slider (CVE-2025-49956). Risk of unauthorized operations or information disclosure. CVE-2025-49956
- High 7.1 Cross-Site Scripting (XSS) in WP Smart Flexslider Cross-site scripting in WP Smart Flexslider (CVE-2025-49955). Risk of unauthorized operations or information disclosure. CVE-2025-49955
- High 7.1 Cross-Site Scripting (XSS) in Email Attachment by Order Status & Products Cross-site scripting in Email Attachment by Order Status & Products (CVE-2025-49957). Risk of unauthorized operations or information disclosure. CVE-2025-49957
- High 7.1 Cross-Site Scripting (XSS) in Robokassa payment gateway for Woocommerce Cross-site scripting in Robokassa payment gateway for Woocommerce (CVE-2025-49958). Risk of unauthorized operations or information disclosure. CVE-2025-49958
- High 7.1 Cross-Site Scripting (XSS) in bbPress Move Topics Cross-site scripting in bbPress Move Topics (CVE-2025-49959). Risk of unauthorized operations or information disclosure. CVE-2025-49959
- Medium 6.5 Cross-Site Scripting (XSS) in LeadBI Plugin for WordPress Cross-site scripting in LeadBI Plugin for WordPress (CVE-2025-49960). Risk of unauthorized operations or information disclosure. CVE-2025-49960
- High 7.1 Cross-Site Scripting (XSS) in WP Super Edit Cross-site scripting in WP Super Edit (CVE-2025-49948). Risk of unauthorized operations or information disclosure. CVE-2025-49948
- High 7.1 Cross-Site Scripting (XSS) in gAppointments Cross-site scripting in gAppointments (CVE-2025-49951). Risk of unauthorized operations or information disclosure. CVE-2025-49951
- High 7.1 Cross-Site Scripting (XSS) in WP-Click-Tracker Cross-site scripting in WP-Click-Tracker (CVE-2025-49954). Risk of unauthorized operations or information disclosure. CVE-2025-49954
- High 7.1 Cross-Site Scripting (XSS) in ShareBang, Ultimate Social Share Buttons for WordPress Cross-site scripting in ShareBang, Ultimate Social Share Buttons for WordPress (CVE-2025-49953). Risk of unauthorized operations or information disclosure. CVE-2025-49953
- Medium 6.5 Cross-Site Scripting (XSS) in JetEngine Cross-site scripting in JetEngine (CVE-2025-49938). Risk of unauthorized operations or information disclosure. CVE-2025-49938
- High 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendons… Cross-site scripting reported (CVE-2025-49947). Risk of unauthorized operations or information disclosure. CVE-2025-49947
- High 7.1 Cross-Site Scripting (XSS) in Auto Login After Registration Cross-site scripting in Auto Login After Registration (CVE-2025-49946). Risk of unauthorized operations or information disclosure. CVE-2025-49946
- High 7.1 Cross-Site Scripting (XSS) in Shortcode Generator Cross-site scripting in Shortcode Generator (CVE-2025-49945). Risk of unauthorized operations or information disclosure. CVE-2025-49945
- High 7.1 Cross-Site Scripting (XSS) in WPCode Content Ratio Cross-site scripting in WPCode Content Ratio (CVE-2025-49944). Risk of unauthorized operations or information disclosure. CVE-2025-49944
- Medium 6.5 Cross-Site Scripting (XSS) in JetElements For Elementor Cross-site scripting in JetElements For Elementor (CVE-2025-49939). Risk of unauthorized operations or information disclosure. CVE-2025-49939
- Medium 6.5 Cross-Site Scripting (XSS) in Fusion Builder Cross-site scripting in Fusion Builder (CVE-2025-49940). Risk of unauthorized operations or information disclosure. CVE-2025-49940
- High 7.1 Cross-Site Scripting (XSS) in JetSearch Cross-site scripting in JetSearch (CVE-2025-49930). Risk of unauthorized operations or information disclosure. CVE-2025-49930
- Medium 6.5 Cross-Site Scripting (XSS) in JetBlog Cross-site scripting in JetBlog (CVE-2025-49932). Risk of unauthorized operations or information disclosure. CVE-2025-49932
- Medium 6.5 Cross-Site Scripting (XSS) in WoodMart Cross-site scripting in WoodMart (CVE-2025-49936). Risk of unauthorized operations or information disclosure. CVE-2025-49936
- Medium 6.5 Cross-Site Scripting (XSS) in JetBlocks For Elementor Cross-site scripting in JetBlocks For Elementor (CVE-2025-49934). Risk of unauthorized operations or information disclosure. CVE-2025-49934
- Medium 6.5 Cross-Site Scripting (XSS) in JetBlog Cross-site scripting in JetBlog (CVE-2025-49933). Risk of unauthorized operations or information disclosure. CVE-2025-49933
- Medium 5.9 Cross-Site Scripting (XSS) in Seriously Simple Podcasting Cross-site scripting in Seriously Simple Podcasting (CVE-2025-49923). Risk of unauthorized operations or information disclosure. CVE-2025-49923