Your RSA-2048 keys break in 2030. Find every one of them before attackers do.

Cross-site Scripting (XSS) vulnerabilities

CWE-79 · 12 tracked

Cross-site scripting (CWE-79) is a flaw where an application reflects untrusted input into a web page without proper encoding, so an attacker’s script runs in another user’s browser.

How it’s exploited

The attacker plants a script — in a URL parameter (reflected), stored content (stored), or the DOM — that executes in a victim’s session, stealing cookies/tokens, performing actions as the victim, or defacing the page.

How to prevent it

Context-aware output encoding, a strict Content-Security-Policy, and treating all user input as untrusted. Frameworks that auto-escape (React, modern templating) prevent most cases when used correctly.

Tracked cross-site scripting (xss) vulnerabilities

12 CVEs in this class, each with severity, exploit status, EPSS, and remediation.

Frequently asked questions

What is Cross-site Scripting (XSS)?
Cross-site scripting (CWE-79) is a flaw where an application reflects untrusted input into a web page without proper encoding, so an attacker’s script runs in another user’s browser.
How is cross-site scripting (xss) exploited?
The attacker plants a script — in a URL parameter (reflected), stored content (stored), or the DOM — that executes in a victim’s session, stealing cookies/tokens, performing actions as the victim, or defacing the page.
How do you prevent cross-site scripting (xss)?
Context-aware output encoding, a strict Content-Security-Policy, and treating all user input as untrusted. Frameworks that auto-escape (React, modern templating) prevent most cases when used correctly.
How many cross-site scripting (xss) vulnerabilities are there?
O3 tracks 12 vulnerabilities classified as CWE-79 (Cross-site Scripting (XSS)), each with severity, exploit status, EPSS exploitation probability, and remediation. The full list is below.