slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,604
- Medium 6.3 Vulnerability in Doctreat CVE-2025-58970
- High 7.1 Cross-Site Scripting (XSS) in WC Return products Cross-site scripting in WC Return products (CVE-2025-59004). Risk of unauthorized operations or information disclosure. CVE-2025-59004
- High 7.1 Cross-Site Scripting (XSS) in Doctreat Cross-site scripting in Doctreat (CVE-2025-58971). Risk of unauthorized operations or information disclosure. CVE-2025-58971
- High 7.1 Cross-Site Scripting (XSS) in Easy Woocommerce Customizer Cross-site scripting in Easy Woocommerce Customizer (CVE-2025-59006). Risk of unauthorized operations or information disclosure. CVE-2025-59006
- High 7.1 Cross-Site Scripting (XSS) in WP Tactical Popup Cross-site scripting in WP Tactical Popup (CVE-2025-58921). Risk of unauthorized operations or information disclosure. CVE-2025-58921
- High 7.1 Cross-Site Scripting (XSS) in NEX-Forms LITE Cross-site scripting in NEX-Forms LITE (CVE-2025-58966). Risk of unauthorized operations or information disclosure. CVE-2025-58966
- High 7.1 Cross-Site Scripting (XSS) in CF7 Auto Responder Addon Cross-site scripting in CF7 Auto Responder Addon (CVE-2025-58961). Risk of unauthorized operations or information disclosure. CVE-2025-58961
- High 7.1 Cross-Site Scripting (XSS) in SEO Pyramid Cross-site scripting in SEO Pyramid (CVE-2025-53427). Risk of unauthorized operations or information disclosure. CVE-2025-53427
- High 7.1 Cross-Site Scripting (XSS) in Likert Survey Master Cross-site scripting in Likert Survey Master (CVE-2025-53426). Risk of unauthorized operations or information disclosure. CVE-2025-53426
- High 7.1 Cross-Site Scripting (XSS) in Grid Plus Cross-site scripting in Grid Plus (CVE-2025-53352). Risk of unauthorized operations or information disclosure. CVE-2025-53352
- High 7.1 Cross-Site Scripting (XSS) in Fidelo Snippet Cross-site scripting in Fidelo Snippet (CVE-2025-53351). Risk of unauthorized operations or information disclosure. CVE-2025-53351
- High 7.1 Cross-Site Scripting (XSS) in WPLMS Cross-site scripting in WPLMS (CVE-2025-53420). Risk of unauthorized operations or information disclosure. CVE-2025-53420
- High 7.1 Cross-Site Scripting (XSS) in WhatsApp Chat for WordPress and WooCommerce Cross-site scripting in WhatsApp Chat for WordPress and WooCommerce (CVE-2025-53422). Risk of unauthorized operations or information disclosure. CVE-2025-53422
- High 7.1 Cross-Site Scripting (XSS) in Triss Cross-site scripting in Triss (CVE-2025-53423). Risk of unauthorized operations or information disclosure. CVE-2025-53423
- High 7.1 Cross-Site Scripting (XSS) in RockON DJ Cross-site scripting in RockON DJ (CVE-2025-53229). Risk of unauthorized operations or information disclosure. CVE-2025-53229
- High 7.1 Cross-Site Scripting (XSS) in Toast Mobile Menu Cross-site scripting in Toast Mobile Menu (CVE-2025-53238). Risk of unauthorized operations or information disclosure. CVE-2025-53238
- High 7.1 Cross-Site Scripting (XSS) in Calendar Plus Cross-site scripting in Calendar Plus (CVE-2025-53350). Risk of unauthorized operations or information disclosure. CVE-2025-53350
- High 7.1 Cross-Site Scripting (XSS) in UDesign Core Cross-site scripting in UDesign Core (CVE-2025-53234). Risk of unauthorized operations or information disclosure. CVE-2025-53234
- High 7.1 Cross-Site Scripting (XSS) in Woocommerce Envato Affiliates Cross-site scripting in Woocommerce Envato Affiliates (CVE-2025-53297). Risk of unauthorized operations or information disclosure. CVE-2025-53297
- High 7.1 Cross-Site Scripting (XSS) in Nifty Backups Cross-site scripting in Nifty Backups (CVE-2025-52763). Risk of unauthorized operations or information disclosure. CVE-2025-52763
- High 7.1 Cross-Site Scripting (XSS) in Hello Followers Cross-site scripting in Hello Followers (CVE-2025-52770). Risk of unauthorized operations or information disclosure. CVE-2025-52770
- High 7.1 Cross-Site Scripting (XSS) in Child Themes Cross-site scripting in Child Themes (CVE-2025-52755). Risk of unauthorized operations or information disclosure. CVE-2025-52755
- High 7.1 Cross-Site Scripting (XSS) in Sello ChannelConnector Cross-site scripting in Sello ChannelConnector (CVE-2025-52754). Risk of unauthorized operations or information disclosure. CVE-2025-52754
- High 7.1 Cross-Site Scripting (XSS) in MultiSite Clone Duplicator Cross-site scripting in MultiSite Clone Duplicator (CVE-2025-52760). Risk of unauthorized operations or information disclosure. CVE-2025-52760
- High 7.1 Cross-Site Scripting (XSS) in Post Connector Cross-site scripting in Post Connector (CVE-2025-52741). Risk of unauthorized operations or information disclosure. CVE-2025-52741
- High 7.1 Cross-Site Scripting (XSS) in Pets Cross-site scripting in Pets (CVE-2025-52742). Risk of unauthorized operations or information disclosure. CVE-2025-52742
- High 7.1 Cross-Site Scripting (XSS) in Uji Countdown Cross-site scripting in Uji Countdown (CVE-2025-52749). Risk of unauthorized operations or information disclosure. CVE-2025-52749
- High 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins… Cross-site scripting reported (CVE-2025-52748). Risk of unauthorized operations or information disclosure. CVE-2025-52748
- High 7.1 Cross-Site Scripting (XSS) in oik-privacy-policy Cross-site scripting in oik-privacy-policy (CVE-2025-52743). Risk of unauthorized operations or information disclosure. CVE-2025-52743
- High 7.1 Cross-Site Scripting (XSS) in Slide Puzzle Cross-site scripting in Slide Puzzle (CVE-2025-52751). Risk of unauthorized operations or information disclosure. CVE-2025-52751