XSS lets attackers run scripts in a victim's browser, enabling data theft or account abuse; contextual output encoding and CSP reduce risk.
Search across headline titles and summaries.
Background for this topic.
Cross-site scripting (XSS) is a web-application flaw in which attacker-controlled input is interpreted as script in another user’s browser. It can be stored in application data, reflected in an immediate response, or introduced by unsafe client-side code (DOM-based XSS). The script runs in the affected site’s origin, so it may read page content, alter requests, or perform actions available to the victim; impact depends on the victim’s privileges and the application’s defenses.
The primary mitigation is context-aware output encoding: treat untrusted data as text when inserting it into HTML, attributes, URLs, JavaScript, or CSS, and use safe DOM APIs such as textContent rather than unsafe HTML insertion. If user-authored HTML is required, apply a well-tested HTML sanitizer. A restrictive Content Security Policy can limit exploitability but is defense in depth, not a substitute for correct encoding. HttpOnly cookies can reduce direct cookie theft, but do not prevent XSS from performing in-session actions.
Weekly headline count for the current query.
The individual is accused of numerous illicit cybercrime and ransomware activities that have generated at least $7m in profit
Some 36% of Grafana instances are vulnerable to account takeover bug, putting DevOps teams at risk
In Operation RoundPress, the compromise vector is a spearphishing email leveraging an XSS vulnerability to inject malicious JavaScript code into the victim's webmail page
Elementor plugin flaw puts 2m WordPress websites at risk, allowing XSS attacks via malicious scripts
The new LiteSpeed Cache flaw (CVE-2024-47374) allows unauthenticated code injection across more than six million active installations
The US Cybersecurity and Infrastructure Security Agency is trying to eradicate cross-site scripting vulnerabilities
As the US presidential election draws near, polling company Gallup acts to block XSS vulnerability
Salt Labs also said XSS combined with OAuth can lead to severe breaches
According to Resecurity, a significant portion of the stolen data was found on the XSS underground forum
Slider Revolution is a widely used premium Wordpress plugin with over 9 million active users
ESET Research reported the vulnerability to the Roundcube team on October 12
They could allow unauthorized access to sessions within the compromised Azure service iframe
The cross-site scripting flaw affects SFX version 9.1.1436.9590 or earlier and has a CVSS of 8.2
Threat actors could exploit the flaw to take complete control of the ConnectWise platform