slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service9348
SQL Injection4153
Remote Code Execution3468
Path Traversal2198
Privilege Escalation1620
Cross-Site Request Forgery1130
Server-Side Request Forgery907
Authentication Bypass900
Insecure Deserialization818
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,676
- Medium 6.4 Cross-Site Scripting (XSS) in WP AD Gallery (WordPress plugin) Cross-site scripting in WP AD Gallery (WordPress plugin) (CVE-2025-11834). Risk of unauthorized operations or information disclosure. CVE-2025-11834
- Medium 6.4 Cross-Site Scripting (XSS) in WP Restaurant Listings (WordPress plugin) Cross-site scripting in WP Restaurant Listings (WordPress plugin) (CVE-2025-11830). Risk of unauthorized operations or information disclosure. CVE-2025-11830
- Medium 6.4 Cross-Site Scripting (XSS) in Playerzbr (WordPress plugin) Cross-site scripting in Playerzbr (WordPress plugin) (CVE-2025-11825). Risk of unauthorized operations or information disclosure. CVE-2025-11825
- Medium 6.4 Cross-Site Scripting (XSS) in Photographers galleries (WordPress plugin) Cross-site scripting in Photographers galleries (WordPress plugin) (CVE-2025-11866). Risk of unauthorized operations or information disclosure. Exploitable via raw_css. CVE-2025-11866
- Medium 6.4 Cross-Site Scripting (XSS) in Oboxmedia Ads (WordPress plugin) Cross-site scripting in Oboxmedia Ads (WordPress plugin) (CVE-2025-11827). Risk of unauthorized operations or information disclosure. CVE-2025-11827
- Medium 6.4 Cross-Site Scripting (XSS) in Simple Youtube Shortcode (WordPress plugin) Cross-site scripting in Simple Youtube Shortcode (WordPress plugin) (CVE-2025-11811). Risk of unauthorized operations or information disclosure. CVE-2025-11811
- Medium 6.4 Cross-Site Scripting (XSS) in Responsive iframe GoogleMap (WordPress plugin) Cross-site scripting in Responsive iframe GoogleMap (WordPress plugin) (CVE-2025-11813). Risk of unauthorized operations or information disclosure. CVE-2025-11813
- Medium 6.4 Cross-Site Scripting (XSS) in Simple Tableau Viz (WordPress plugin) Cross-site scripting in Simple Tableau Viz (WordPress plugin) (CVE-2025-11817). Risk of unauthorized operations or information disclosure. CVE-2025-11817
- Medium 6.4 Cross-Site Scripting (XSS) in Cinza Grid (WordPress plugin) Cross-site scripting in Cinza Grid (WordPress plugin) (CVE-2025-11824). Risk of unauthorized operations or information disclosure. CVE-2025-11824
- Medium 6.4 Cross-Site Scripting (XSS) in WP-Thumbnail (WordPress plugin) Cross-site scripting in WP-Thumbnail (WordPress plugin) (CVE-2025-11819). Risk of unauthorized operations or information disclosure. CVE-2025-11819
- Medium 6.4 Cross-Site Scripting (XSS) in WP Responsive Meet The Team (WordPress plugin) Cross-site scripting in WP Responsive Meet The Team (WordPress plugin) (CVE-2025-11818). Risk of unauthorized operations or information disclosure. CVE-2025-11818
- Medium 6.4 Cross-Site Scripting (XSS) in JB News Ticker (WordPress plugin) Cross-site scripting in JB News Ticker (WordPress plugin) (CVE-2025-11804). Risk of unauthorized operations or information disclosure. CVE-2025-11804
- Medium 6.4 Cross-Site Scripting (XSS) in WP-Force Images Download (WordPress plugin) Cross-site scripting in WP-Force Images Download (WordPress plugin) (CVE-2025-11809). Risk of unauthorized operations or information disclosure. CVE-2025-11809
- Medium 6.4 Cross-Site Scripting (XSS) in Mixlr Shortcode (WordPress plugin) Cross-site scripting in Mixlr Shortcode (WordPress plugin) (CVE-2025-11807). Risk of unauthorized operations or information disclosure. CVE-2025-11807
- Medium 6.4 Cross-Site Scripting (XSS) in Print Button Shortcode (WordPress plugin) Cross-site scripting in Print Button Shortcode (WordPress plugin) (CVE-2025-11810). Risk of unauthorized operations or information disclosure. CVE-2025-11810
- Medium 6.4 Cross-Site Scripting (XSS) in This-or-That (WordPress plugin) Cross-site scripting in This-or-That (WordPress plugin) (CVE-2025-10138). Risk of unauthorized operations or information disclosure. CVE-2025-10138
- Medium 4.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12033). Risk of unauthorized operations or information disclosure. CVE-2025-12033
- Medium 5.5 Cross-Site Scripting (XSS) in Welcart e-Commerce (WordPress plugin) Cross-site scripting in Welcart e-Commerce (WordPress plugin) (CVE-2025-10651). Risk of unauthorized operations or information disclosure. CVE-2025-10651
- Medium 6.1 Cross-Site Scripting (XSS) in Liferay Portal Cross-site scripting in Liferay Portal (CVE-2025-62249). Risk of unauthorized operations or information disclosure. CVE-2025-62249
- Medium 6.1 Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2025-62598). Risk of unauthorized operations or information disclosure. Exploitable via GET /WeGIA/html/pessoa/editar_info_pessoal.php. CVE-2025-62598
- Medium 6.1 Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2025-62597). Risk of unauthorized operations or information disclosure. Exploitable via GET /WeGIA/html/pessoa/editar_info_pessoal.php. CVE-2025-62597
- Medium 6.1 Cross-Site Scripting (XSS) in City Guide Cross-site scripting in City Guide (CVE-2025-10612). Risk of unauthorized operations or information disclosure. CVE-2025-10612
- Unrated Cross-Site Scripting (XSS) in Mediawiki - PageTriage Extension Cross-site scripting in Mediawiki - PageTriage Extension (CVE-2025-62702). Risk of unauthorized operations or information disclosure. CVE-2025-62702
- Unrated Cross-Site Scripting (XSS) in Mediawiki - Wikistories Cross-site scripting in Mediawiki - Wikistories (CVE-2025-62701). Risk of unauthorized operations or information disclosure. CVE-2025-62701
- Unrated Cross-Site Scripting (XSS) in Mediawiki - WikiLove Extension Cross-site scripting in Mediawiki - WikiLove Extension (CVE-2025-62694). Risk of unauthorized operations or information disclosure. CVE-2025-62694
- Unrated Cross-Site Scripting (XSS) in Mediawiki - WikiLambda Extension Cross-site scripting in Mediawiki - WikiLambda Extension (CVE-2025-62695). Risk of unauthorized operations or information disclosure. CVE-2025-62695
- Medium 6.1 Vulnerability in BLU-IC2 CVE-2025-12001
- Unrated Cross-Site Scripting (XSS) in MediaWiki GlobalBlocking extension Cross-site scripting in MediaWiki GlobalBlocking extension (CVE-2025-62656). Risk of unauthorized operations or information disclosure. CVE-2025-62656
- Unrated Cross-Site Scripting (XSS) in MediaWiki PageForms extension Cross-site scripting in MediaWiki PageForms extension (CVE-2025-62657). Risk of unauthorized operations or information disclosure. CVE-2025-62657
- Unrated Cross-Site Scripting (XSS) in Mediawiki - ExternalGuidance Cross-site scripting in Mediawiki - ExternalGuidance (CVE-2025-62698). Risk of unauthorized operations or information disclosure. CVE-2025-62698