slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8952
SQL Injection4127
Remote Code Execution3108
Path Traversal2163
Privilege Escalation1605
Cross-Site Request Forgery1123
Server-Side Request Forgery895
Authentication Bypass888
Insecure Deserialization809
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,608
- Medium 6.4 Cross-Site Scripting (XSS) in WP-Thumbnail (WordPress plugin) Cross-site scripting in WP-Thumbnail (WordPress plugin) (CVE-2025-11819). Risk of unauthorized operations or information disclosure. CVE-2025-11819
- Medium 6.4 Cross-Site Scripting (XSS) in WP Responsive Meet The Team (WordPress plugin) Cross-site scripting in WP Responsive Meet The Team (WordPress plugin) (CVE-2025-11818). Risk of unauthorized operations or information disclosure. CVE-2025-11818
- Medium 6.4 Cross-Site Scripting (XSS) in Simple Tableau Viz (WordPress plugin) Cross-site scripting in Simple Tableau Viz (WordPress plugin) (CVE-2025-11817). Risk of unauthorized operations or information disclosure. CVE-2025-11817
- Medium 6.4 Cross-Site Scripting (XSS) in Responsive iframe GoogleMap (WordPress plugin) Cross-site scripting in Responsive iframe GoogleMap (WordPress plugin) (CVE-2025-11813). Risk of unauthorized operations or information disclosure. CVE-2025-11813
- Medium 6.4 Cross-Site Scripting (XSS) in Simple Youtube Shortcode (WordPress plugin) Cross-site scripting in Simple Youtube Shortcode (WordPress plugin) (CVE-2025-11811). Risk of unauthorized operations or information disclosure. CVE-2025-11811
- Medium 6.4 Cross-Site Scripting (XSS) in Print Button Shortcode (WordPress plugin) Cross-site scripting in Print Button Shortcode (WordPress plugin) (CVE-2025-11810). Risk of unauthorized operations or information disclosure. CVE-2025-11810
- Medium 6.4 Cross-Site Scripting (XSS) in WP-Force Images Download (WordPress plugin) Cross-site scripting in WP-Force Images Download (WordPress plugin) (CVE-2025-11809). Risk of unauthorized operations or information disclosure. CVE-2025-11809
- Medium 6.4 Cross-Site Scripting (XSS) in Mixlr Shortcode (WordPress plugin) Cross-site scripting in Mixlr Shortcode (WordPress plugin) (CVE-2025-11807). Risk of unauthorized operations or information disclosure. CVE-2025-11807
- Medium 6.4 Cross-Site Scripting (XSS) in JB News Ticker (WordPress plugin) Cross-site scripting in JB News Ticker (WordPress plugin) (CVE-2025-11804). Risk of unauthorized operations or information disclosure. CVE-2025-11804
- Medium 6.4 Cross-Site Scripting (XSS) in This-or-That (WordPress plugin) Cross-site scripting in This-or-That (WordPress plugin) (CVE-2025-10138). Risk of unauthorized operations or information disclosure. CVE-2025-10138
- Medium 4.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12033). Risk of unauthorized operations or information disclosure. CVE-2025-12033
- Medium 5.5 Cross-Site Scripting (XSS) in Welcart e-Commerce (WordPress plugin) Cross-site scripting in Welcart e-Commerce (WordPress plugin) (CVE-2025-10651). Risk of unauthorized operations or information disclosure. CVE-2025-10651
- Medium 6.1 Cross-Site Scripting (XSS) in Liferay Portal Cross-site scripting in Liferay Portal (CVE-2025-62249). Risk of unauthorized operations or information disclosure. CVE-2025-62249
- Medium 6.1 Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2025-62598). Risk of unauthorized operations or information disclosure. Exploitable via GET /WeGIA/html/pessoa/editar_info_pessoal.php. CVE-2025-62598
- Medium 6.1 Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2025-62597). Risk of unauthorized operations or information disclosure. Exploitable via GET /WeGIA/html/pessoa/editar_info_pessoal.php. CVE-2025-62597
- Medium 6.1 Cross-Site Scripting (XSS) in City Guide Cross-site scripting in City Guide (CVE-2025-10612). Risk of unauthorized operations or information disclosure. CVE-2025-10612
- Unrated Cross-Site Scripting (XSS) in Mediawiki - PageTriage Extension Cross-site scripting in Mediawiki - PageTriage Extension (CVE-2025-62702). Risk of unauthorized operations or information disclosure. CVE-2025-62702
- Unrated Cross-Site Scripting (XSS) in Mediawiki - Wikistories Cross-site scripting in Mediawiki - Wikistories (CVE-2025-62701). Risk of unauthorized operations or information disclosure. CVE-2025-62701
- Unrated Cross-Site Scripting (XSS) in Mediawiki - WikiLove Extension Cross-site scripting in Mediawiki - WikiLove Extension (CVE-2025-62694). Risk of unauthorized operations or information disclosure. CVE-2025-62694
- Unrated Cross-Site Scripting (XSS) in Mediawiki - WikiLambda Extension Cross-site scripting in Mediawiki - WikiLambda Extension (CVE-2025-62695). Risk of unauthorized operations or information disclosure. CVE-2025-62695
- Medium 6.1 Vulnerability in BLU-IC2 CVE-2025-12001
- Unrated Cross-Site Scripting (XSS) in MediaWiki GlobalBlocking extension Cross-site scripting in MediaWiki GlobalBlocking extension (CVE-2025-62656). Risk of unauthorized operations or information disclosure. CVE-2025-62656
- Unrated Cross-Site Scripting (XSS) in MediaWiki PageForms extension Cross-site scripting in MediaWiki PageForms extension (CVE-2025-62657). Risk of unauthorized operations or information disclosure. CVE-2025-62657
- Unrated Cross-Site Scripting (XSS) in Mediawiki - ExternalGuidance Cross-site scripting in Mediawiki - ExternalGuidance (CVE-2025-62698). Risk of unauthorized operations or information disclosure. CVE-2025-62698
- Unrated Cross-Site Scripting (XSS) in Mediawiki - LastModified Extension Cross-site scripting in Mediawiki - LastModified Extension (CVE-2025-62693). Risk of unauthorized operations or information disclosure. CVE-2025-62693
- Unrated Cross-Site Scripting (XSS) in Mediawiki - MultiBoilerplate Extensionmaste Cross-site scripting in Mediawiki - MultiBoilerplate Extensionmaste (CVE-2025-62700). Risk of unauthorized operations or information disclosure. CVE-2025-62700
- Unrated Cross-Site Scripting (XSS) in Tawk Live Chat Cross-site scripting in Tawk Live Chat (CVE-2025-8349). Risk of unauthorized operations or information disclosure. CVE-2025-8349
- Low 3.5 Cross-Site Scripting (XSS) in LogicalDOC Community Edition Cross-site scripting in LogicalDOC Community Edition (CVE-2025-11946). Risk of unauthorized operations or information disclosure. CVE-2025-11946
- Low 3.5 Cross-Site Scripting (XSS) in toeverything AFFiNE Cross-site scripting in toeverything AFFiNE (CVE-2025-11945). Risk of unauthorized operations or information disclosure. CVE-2025-11945
- Medium 4.4 Cross-Site Scripting (XSS) in Related Posts Lite (WordPress plugin) Cross-site scripting in Related Posts Lite (WordPress plugin) (CVE-2025-11926). Risk of unauthorized operations or information disclosure. CVE-2025-11926