slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8952
SQL Injection4127
Remote Code Execution3108
Path Traversal2163
Privilege Escalation1605
Cross-Site Request Forgery1123
Server-Side Request Forgery895
Authentication Bypass888
Insecure Deserialization809
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,608
- Medium 6.5 Cross-Site Scripting (XSS) in JetBlog Cross-site scripting in JetBlog (CVE-2025-49933). Risk of unauthorized operations or information disclosure. CVE-2025-49933
- Medium 6.5 Cross-Site Scripting (XSS) in JetBlocks For Elementor Cross-site scripting in JetBlocks For Elementor (CVE-2025-49934). Risk of unauthorized operations or information disclosure. CVE-2025-49934
- Medium 6.5 Cross-Site Scripting (XSS) in WoodMart Cross-site scripting in WoodMart (CVE-2025-49936). Risk of unauthorized operations or information disclosure. CVE-2025-49936
- Medium 5.9 Cross-Site Scripting (XSS) in Seriously Simple Podcasting Cross-site scripting in Seriously Simple Podcasting (CVE-2025-49923). Risk of unauthorized operations or information disclosure. CVE-2025-49923
- Medium 6.5 Cross-Site Scripting (XSS) in JetWooBuilder Cross-site scripting in JetWooBuilder (CVE-2025-49927). Risk of unauthorized operations or information disclosure. CVE-2025-49927
- Medium 6.5 Cross-Site Scripting (XSS) in JetWooBuilder Cross-site scripting in JetWooBuilder (CVE-2025-49928). Risk of unauthorized operations or information disclosure. CVE-2025-49928
- High 7.1 Cross-Site Scripting (XSS) in WooCommerce Vehicle Parts Finder Cross-site scripting in WooCommerce Vehicle Parts Finder (CVE-2025-49911). Risk of unauthorized operations or information disclosure. CVE-2025-49911
- Medium 5.9 Cross-Site Scripting (XSS) in Email Subscription Popup Cross-site scripting in Email Subscription Popup (CVE-2025-49912). Risk of unauthorized operations or information disclosure. CVE-2025-49912
- Medium 6.5 Cross-Site Scripting (XSS) in WPC Countdown Timer for WooCommerce Cross-site scripting in WPC Countdown Timer for WooCommerce (CVE-2025-49908). Risk of unauthorized operations or information disclosure. CVE-2025-49908
- High 7.1 Cross-Site Scripting (XSS) in Password only login Cross-site scripting in Password only login (CVE-2025-48093). Risk of unauthorized operations or information disclosure. CVE-2025-48093
- Medium 5.9 Cross-Site Scripting (XSS) in Survey Maker Cross-site scripting in Survey Maker (CVE-2025-48095). Risk of unauthorized operations or information disclosure. CVE-2025-48095
- High 7.1 Cross-Site Scripting (XSS) in WSAnalytics Cross-site scripting in WSAnalytics (CVE-2025-48097). Risk of unauthorized operations or information disclosure. CVE-2025-48097
- High 7.1 Cross-Site Scripting (XSS) in Survey Maker Cross-site scripting in Survey Maker (CVE-2025-48098). Risk of unauthorized operations or information disclosure. CVE-2025-48098
- High 7.1 Cross-Site Scripting (XSS) in Terms Dictionary Cross-site scripting in Terms Dictionary (CVE-2025-39534). Risk of unauthorized operations or information disclosure. CVE-2025-39534
- High 7.1 Cross-Site Scripting (XSS) in Fix Multiple Redirects Cross-site scripting in Fix Multiple Redirects (CVE-2025-48092). Risk of unauthorized operations or information disclosure. CVE-2025-48092
- Medium 6.4 Cross-Site Scripting (XSS) in Eclipse Vert.x Cross-site scripting in Eclipse Vert.x (CVE-2025-11966). Risk of unauthorized operations or information disclosure. CVE-2025-11966
- Medium 5.4 Code Injection in Librechat CVE-2025-8848
- Medium 6.4 Cross-Site Scripting (XSS) in Responsive Progress Bar (WordPress plugin) Cross-site scripting in Responsive Progress Bar (WordPress plugin) (CVE-2025-11883). Risk of unauthorized operations or information disclosure. CVE-2025-11883
- Medium 6.1 Cross-Site Scripting (XSS) in Oct8Ne Cross-site scripting in Oct8Ne (CVE-2025-11952). Risk of unauthorized operations or information disclosure. CVE-2025-11952
- Medium 6.4 Cross-Site Scripting (XSS) in Bg Book Publisher (WordPress plugin) Cross-site scripting in Bg Book Publisher (WordPress plugin) (CVE-2025-11867). Risk of unauthorized operations or information disclosure. Exploitable via book_author. CVE-2025-11867
- Medium 6.4 Cross-Site Scripting (XSS) in SM CountDown Widget (WordPress plugin) Cross-site scripting in SM CountDown Widget (WordPress plugin) (CVE-2025-11880). Risk of unauthorized operations or information disclosure. CVE-2025-11880
- Medium 6.4 Cross-Site Scripting (XSS) in ST Categories Widget (WordPress plugin) Cross-site scripting in ST Categories Widget (WordPress plugin) (CVE-2025-11878). Risk of unauthorized operations or information disclosure. CVE-2025-11878
- Medium 6.4 Cross-Site Scripting (XSS) in Material Design Iconic Font Integration (WordPress plugin) Cross-site scripting in Material Design Iconic Font Integration (WordPress plugin) (CVE-2025-11872). Risk of unauthorized operations or information disclosure. CVE-2025-11872
- Medium 6.4 Cross-Site Scripting (XSS) in Simple Business Data (WordPress plugin) Cross-site scripting in Simple Business Data (WordPress plugin) (CVE-2025-11870). Risk of unauthorized operations or information disclosure. Exploitable via type. CVE-2025-11870
- Medium 6.4 Cross-Site Scripting (XSS) in WP Restaurant Listings (WordPress plugin) Cross-site scripting in WP Restaurant Listings (WordPress plugin) (CVE-2025-11830). Risk of unauthorized operations or information disclosure. CVE-2025-11830
- Medium 6.4 Cross-Site Scripting (XSS) in Playerzbr (WordPress plugin) Cross-site scripting in Playerzbr (WordPress plugin) (CVE-2025-11825). Risk of unauthorized operations or information disclosure. CVE-2025-11825
- Medium 6.4 Cross-Site Scripting (XSS) in WP AD Gallery (WordPress plugin) Cross-site scripting in WP AD Gallery (WordPress plugin) (CVE-2025-11834). Risk of unauthorized operations or information disclosure. CVE-2025-11834
- Medium 6.4 Cross-Site Scripting (XSS) in Photographers galleries (WordPress plugin) Cross-site scripting in Photographers galleries (WordPress plugin) (CVE-2025-11866). Risk of unauthorized operations or information disclosure. Exploitable via raw_css. CVE-2025-11866
- Medium 6.4 Cross-Site Scripting (XSS) in Oboxmedia Ads (WordPress plugin) Cross-site scripting in Oboxmedia Ads (WordPress plugin) (CVE-2025-11827). Risk of unauthorized operations or information disclosure. CVE-2025-11827
- Medium 6.4 Cross-Site Scripting (XSS) in Simple Youtube Shortcode (WordPress plugin) Cross-site scripting in Simple Youtube Shortcode (WordPress plugin) (CVE-2025-11811). Risk of unauthorized operations or information disclosure. CVE-2025-11811