The newest Cross-Site Scripting (XSS) resources are on the Cross-Site Scripting (XSS) page. For a reading order instead of a date order, see the Cross-Site Scripting (XSS) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-22 2026 | CVE-2025-0133: PAN-OS Reflected XSS in GlobalProtect Gateway news 2 min read | Writeup detailing CVE-2025-0133, a reflected XSS vulnerability in Palo Alto Networks PAN-OS GlobalProtect gateway and portal. This flaw allows attackers to execute malicious JavaScript in a user's browser via crafted links, primarily posing a risk of phishing and credential theft, especially when Clientless VPN is enabled. Mitigation involves enabling Threat IDs 510003 and 510004 via Threat Prevention content version 8995, applying Vulnerability Protection profiles to security rules, or disabling Clientless VPN. |
| 2026-04-22 2026 | Synthesizing XSS Polyglots with Monte Carlo Tree Search (arXiv 2025) advanced | Synthesizing XSS Polyglots with Monte Carlo Tree Search (arXiv 2025) → arxiv.org |
| 2026-04-19 2026 | Bypassing Signature-Based XSS Filters: Modifying HTML intermediate 2 min read | Technique for bypassing signature-based XSS filters by modifying HTML syntax, demonstrating methods to obfuscate payloads. It explores variations in tag casing, insertion of NULL bytes and superfluous characters, use of alternative attribute delimiters like backticks, and HTML encoding within attribute values to evade detection. Examples are provided using DVWA and OWASP's Broken Web Application Project. → portswigger.net |
| 2026-04-19 2026 | Advanced XSS Filter Bypass Methods Using Payload Splitting advanced | Advanced XSS Filter Bypass Methods Using Payload Splitting |
| 2026-04-19 2026 | Intigriti July 2025 XSS Challenge — Jorian Woltjer beginner 12 min read | Library for bypassing XSS filters, leveraging DOM clobbering and Mutation XSS techniques. It demonstrates how to exploit HTML parsing quirks, specifically "foster parenting" within table elements and "node flattening," to manipulate the DOM and override critical elements like `chat-messages`. The library also showcases a method to bypass Content Security Policy (CSP) by exploiting a Socket.IO polling endpoint, reflecting input in a way that allows JavaScript execution. |
| 2026-04-17 2026 | Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow news 7 min read | Library detailing three XSS vulnerabilities found in Mailcow, including a critical unauthenticated flaw affecting administrator accounts via Autodiscover logs (GHSA-f9xf-vc72-rcgm). Another XSS targets administrators through attachment filenames in the Quarantine feature (GHSA-2xjc-rg88-jvpp), and a Self-XSS in Login History is escalated via Login CSRF (GHSA-jprq-w83q-q62h). All issues have been fixed since version 2026-03b. → aikido.dev |
| 2026-04-16 2026 | Bypassing DOMPurify with Good Old XML advanced 5 min read | Writeup detailing DOMPurify bypasses found by exploiting parsing inconsistencies between XML and HTML for Processing Instructions (`<?...?>`) and CDATA sections (`<![CDATA[...]]>`). The first bypass leveraged the differing interpretation of Processing Instructions, allowing arbitrary `nodeName` injection. A subsequent bypass exploited how HTML parsers handle CDATA sections outside SVG/MathML, treating them as bogus comments ending with `>` instead of `]]>`. These vulnerabilities were addressed by updates to DOMPurify's node filtering. |
| 2026-04-16 2026 | Exploring the DOMPurify Library: Bypasses and Fixes intermediate 17 min read | Article detailing bypasses and fixes for the DOMPurify library, exploring how client-side HTML sanitizers work. It highlights vulnerabilities arising from inconsistent HTML parsing, namespace manipulations (e.g., SVG and MathML interactions), and deviations in handling nested element limits. Specific techniques like double parsing, the use of `<form>` element restrictions, and mutations exploiting HTML insertion modes and the stack of open elements are discussed, referencing bypasses like the one found in DOMPurify versions <= 3.1.0 by @IcesFont. |
| 2026-04-16 2026 | Content Security Policy Bypass Techniques Collection intermediate 8 min read | Collection of Content Security Policy (CSP) bypass techniques detailing directives like `script-src`, `default-src`, and `frame-ancestors`, and sources such as `'self'`, `'unsafe-inline'`, and `'unsafe-eval'`. This resource analyzes how CSP mitigates content injection like XSS, yet remains vulnerable to bypasses when misconfigured, highlighting the importance of thorough policy evaluation using tools like CSP Evaluator and CSP Validator. It provides practical examples of exploitable CSP configurations leading to script execution. |
| 2026-04-16 2026 | CSPBypass: Tool to Bypass Content Security Policies intermediate 2 min read | Tool for bypassing Content Security Policies (CSP) to exploit XSS vulnerabilities, CSPBypass helps ethical hackers find existing bypass gadgets or contribute new ones. It identifies CSP loopholes, often leveraging JSONP endpoints or JavaScript libraries on whitelisted domains, to execute JavaScript despite restrictive policies. The project encourages community contributions of new bypass techniques, with a dataset curated from Common Crawl for identifying commonly whitelisted domains. |
| 2026-04-16 2026 | PayloadsAllTheThings: XSS Injection Cheat Sheet beginner 11 min read | Cheatsheet of XSS injection techniques and payloads, covering methodology, proof of concept examples, and common injection vectors like HTML wrappers, PostMessage, blind XSS, and mutated XSS. It details payload strategies for capturing sensitive data such as cookies and access tokens, crafting fake login forms, keylogging, and exploiting DOM-based vulnerabilities. The resource also highlights effective payloads for modern applications, including sandbox domain contexts, and lists tools like XSSStrike, xsser, Dalfox, and XSpear for blind XSS detection. |
| 2026-04-16 2026 | Advanced XSS Exploitation: Bypassing CSP and DOM Sanitization advanced | Advanced XSS Exploitation: Bypassing CSP and DOM Sanitization |
| 2026-04-16 2026 | CVE-2025-63418: Weaponizing the Browser Console - DOM-based XSS Deep Dive advanced | CVE-2025-63418: Weaponizing the Browser Console - DOM-based XSS Deep Dive |
| 2026-04-16 2026 | bypassXSS: A Curated Collection of Advanced XSS Bypass Techniques advanced 1 min read | Collection of advanced XSS bypass techniques detailing filter types, encoding methods, DOM manipulation, HTML5 abuse, JavaScript context escapes, WAF strategies against Cloudflare and Akamai, framework-specific payloads for AngularJS and React, and CSP misconfigurations. It includes real-world bug bounty case studies and a payload repository for testing tools like DOMPurify and various WAFs. |
| 2026-04-16 2026 | Cross-Site Scripting (XSS) Practical CTF Guide intermediate | Cross-Site Scripting (XSS) Practical CTF Guide |
| 2026-04-10 2026 | Beyond XSS: Mutation XSS Explained beginner 7 min read | Writeup detailing mutation XSS (mXSS) techniques that exploit browser HTML parsing inconsistencies to bypass sanitizers like DOMPurify. It explains how malformed HTML within SVG and style tags can be mutated by browsers, leading to unexpected DOM structures that allow arbitrary code execution through attributes. The article references a specific DOMPurify vulnerability fixed in version 2.0.1. |
| 2026-04-10 2026 | Bypassing DOMPurify Again with Mutation XSS intermediate 2 min read | Writeup detailing a bypass of DOMPurify using Mutation XSS (mXSS). The technique leverages HTML comments and specially crafted tags within a `<math>` element to achieve cross-site scripting. The bypass was initially found to work in Chrome by exploiting how DOMPurify handled mutations within text nodes, specifically by placing malicious code within an image's title attribute after an encoded comment. A subsequent bypass was discovered for Firefox, utilizing CDATA tags instead of HTML comments. The vectors are demonstrated using a custom mXSS tool and are relevant for bypassing HTML filters, with the Chrome vector patched in DOMPurify version 2.1. → portswigger.net |
| 2026-04-10 2026 | Penetration Testing of Electron-based Applications beginner 14 min read | Library for security testing and hardening Electron-based desktop applications, detailing real-world attack vectors and analysis techniques. It covers discovering bundled endpoints, extracting ASAR files, analyzing IPC channels, testing preload bridges, and validating update mechanisms. Techniques include checking dependency vulnerabilities with `npm audit`, inspecting `package.json` for entry points, and analyzing `webPreferences` like `nodeIntegration` and `contextIsolation` for potential XSS and RCE vulnerabilities. |
| 2026-04-10 2026 | DbGate Stored XSS to RCE in Electron (CVE-2026-34725) intermediate | DbGate Stored XSS to RCE in Electron (CVE-2026-34725) → advisories.gitlab.com |
| 2026-04-10 2026 | Intigriti Challenge 0226: Stored XSS & CSP Bypass intermediate | Intigriti Challenge 0226: Stored XSS & CSP Bypass |
| 2026-04-10 2026 | Content Security Policy Bypass Techniques and Security Tips intermediate 7 min read | Survey of Content Security Policy (CSP) bypass techniques, detailing common misconfigurations and exploitation scenarios. It explains CSP directives like `script-src`, `object-src`, `img-src`, and fetch values such as `'self'`, `'unsafe-inline'`, and `'unsafe-eval'`. The survey covers vulnerabilities arising from improper use of wildcards, missing directives, and the exploitation of JSONP endpoints, offering practical advice for strengthening CSP implementation against attacks like XSS. → vaadata.com |
| 2026-04-10 2026 | Advanced XSS: Bypassing Filters, CSP, and DOM-based XSS intermediate 24 min read | Library detailing advanced Cross-Site Scripting (XSS) techniques. It covers bypassing filters, Content Security Policy (CSP), and DOM-based XSS, including 2025 attack vectors, AI agent weaponization, polymorphic payloads, sanitizer bypasses, and advanced CSP evasion via CSS and cache. Specific techniques discussed include mutation XSS (mXSS), WebAssembly, Trusted Types, prompt-to-XSS, DOMPurify mutation XSS bypasses (CVE-2025-26791), nonce leakage, postMessage exploitation, Cross-Site WebSocket Hijacking (CSWSH), GraphQL injection to XSS, payload fragmentation, evolved DOM clobbering (CVE-2025-1647), Server-Sent Events (SSE) injection, and Console/DevTools XSS. |
| 2026-04-10 2026 | CSP Bypasses: Advanced Exploitation Guide advanced 9 min read | Guide detailing Content Security Policy (CSP) bypass techniques, focusing on how misconfigurations allow for XSS exploitation. It covers scenarios like missing CSP declarations, reporting-only modes, non-restrictive directives such as wildcards (`*`) and `unsafe-inline` in `script-src`, and leveraging third-party hosts. The guide references tools like Google CSP Evaluator and common CSP directives, emphasizing that CSP bypasses are typically report-worthy when chained with an actual vulnerability. → intigriti.com |
| 2026-04-10 2026 | Arista Firewall XSS to RCE Chain intermediate 5 min read | Writeup detailing the exploitation chain of CVE-2025-6980, CVE-2025-6979 (an XSS vulnerability), and CVE-2025-6978 against Arista Next Generation Firewalls. This chain allows for remote code execution by combining an XSS vulnerability that steals administrator credentials with a command injection flaw that grants root privileges, a vulnerability the vendor's patch did not fully remediate. Disabling the captive portal is suggested as a mitigation alongside upgrading to the patched software version. → bishopfox.com |
| 2026-04-10 2026 | From Stored XSS to Account Takeover intermediate | From Stored XSS to Account Takeover |
| 2026-04-10 2026 | Magento 2.3.1: Unauthenticated Stored XSS to RCE intermediate 6 min read | Library detailing an unauthenticated stored XSS vulnerability in Magento 2.3.1 that can be chained with authenticated PHAR deserialization for remote code execution. The exploit targets order cancellation notes and leverages an issue in the `escapeHtmlWithLinks()` sanitization method to inject malicious JavaScript. This payload, when triggered by an administrator, allows for session hijacking and subsequent exploitation of a PHAR deserialization flaw within the WYSIWYG editor's image rendering controller, enabling arbitrary code execution. |
| 2026-04-10 2026 | CVE-2025-52367: Stored XSS to RCE in PivotX CMS news | CVE-2025-52367: Stored XSS to RCE in PivotX CMS |
| 2026-04-10 2026 | BXSS Hunter: Blind XSS Scanner Tool intermediate | Tool for detecting blind Cross-Site Scripting (XSS) vulnerabilities by injecting custom payloads into headers and parameters. BxssHunter supports various HTTP methods (PUT, POST, GET, OPTIONS) and allows for payload injection into parameters or custom headers like X-Forwarded-For. It aids in finding vulnerabilities that execute asynchronously, often missed by standard scanners. |
| 2026-04-10 2026 | How to Find XSS Vulnerabilities: Practical Security Guide beginner 9 min read | Library detailing Cross-Site Scripting (XSS) vulnerabilities, covering reflected, stored, and DOM-based types. It provides practical techniques for manual and automated discovery, recommending tools like Dalfox, XSStrike, and xsshunter, alongside payload resources such as PayloadsAllTheThings and HackTricks. Specific examples include blind XSS in admin dashboards and stored XSS in GitLab wikis, emphasizing the use of polyglots and callback platforms for effective exploitation. → hackerone.com |
| 2026-04-10 2026 | Mastering Blind XSS: Real-World Techniques for High Bounties intermediate | Mastering Blind XSS: Real-World Techniques for High Bounties → infosecwriteups.com |
| 2026-04-10 2026 | Hunting for Blind XSS Vulnerabilities: A Complete Guide beginner 7 min read | Guide on hunting blind XSS vulnerabilities, this resource details techniques for identifying and exploiting these elusive injection flaws. It covers setting up necessary tooling, including XSSHunter, and provides a range of advanced payloads for injecting external scripts via SVG, image tags, input tags with autofocus, and JavaScript protocols, as well as bypassing Content Security Policy with base tags and exploiting AngularJS. The guide also highlights key areas to test, such as feedback forms and analytics engines. → intigriti.com |
| 2026-04-10 2026 | The Guide to Blind XSS: Advanced Techniques for Bug Bounty Hunters advanced | The Guide to Blind XSS: Advanced Techniques for Bug Bounty Hunters → bugcrowd.com |
| 2026-04-10 2026 | Frontend Security in 2025: Protecting Client-Side Code in React, Vue & More beginner 3 min read | Library of frontend security practices for 2025, addressing critical risks in React, Vue, and other stacks. It details common vulnerabilities like XSS, session leaks, and insecure token storage (localStorage, accessible cookies), advocating for HttpOnly, Secure, SameSite=Strict cookies. The library also covers rendering vulnerabilities, the importance of Content Security Policy (CSP) configurations, and other web security headers like X-Content-Type-Options and X-Frame-Options. It integrates security checks into CI/CD, suggests sanitization libraries like DOMPurify, and promotes secure architectural decisions. |
| 2026-04-10 2026 | Modern Frontend Security: Beyond XSS and CSRF in 2025 beginner | Modern Frontend Security: Beyond XSS and CSRF in 2025 |
| 2026-04-10 2026 | Cross-site Scripting (XSS) in vue-i18n (CVE-2025-53892) news 2 min read | Writeup on CVE-2025-53892, detailing a Cross-site Scripting (XSS) vulnerability in vue-i18n. This flaw allows attackers to execute arbitrary JavaScript by injecting malicious payloads into translation strings when `escapeParameterHtml` is set to `true`. Affected versions can be upgraded to 9.14.5, 10.0.8, 11.1.10, or higher to mitigate the risk. → security.snyk.io |
| 2026-04-10 2026 | XSS in 2025: Why It Still Matters and How to Defend Against It beginner | XSS in 2025: Why It Still Matters and How to Defend Against It |
| 2026-04-10 2026 | Why React Didn't Kill XSS: The New JavaScript Injection Playbook intermediate 4 min read | Guide detailing modern JavaScript injection techniques, including prototype pollution, supply chain compromises via packages like Polyfill.io, and AI prompt injection. It highlights how frameworks like React don't fully prevent XSS, demonstrating vulnerabilities with `dangerouslySetInnerHTML` and recommending context-aware encoding and tools like DOMPurify. The guide also touches on WebAssembly security considerations and emerging AI threats, offering a defense-in-depth approach for developers building secure applications. → thehackernews.com |
| 2026-04-10 2026 | Security Issues in Popular Full-Stack Frameworks beginner 2 min read | Survey of security issues found in full-stack JavaScript frameworks, including DOM clobbering in React and Vue, cross-site scripting in Next.js, Angular template injection, dependency abuse in UI components, and build-time exploits in Angular and Next.js. These vulnerabilities have been exploited in production and require application-level defenses such as sanitizing attributes, escaping server-rendered data, replacing abandoned third-party components, and monitoring build pipelines. |
| 2026-04-10 2026 | Beyond alert(1): Real XSS Dangers in React & Vue SPAs intermediate 9 min read | Library detailing real-world Cross-Site Scripting (XSS) dangers in React and Vue Single Page Applications (SPAs). It explains how these frameworks, despite default protections, introduce new attack vectors, particularly DOM-based XSS. The library highlights the risks of `dangerouslySetInnerHTML` in React, `v-html` in Vue, and the vulnerability of `localStorage` for storing authentication tokens like JWTs, leading to session hijacking and silent manipulation of displayed data through API exploitation. |
| 2026-04-10 2026 | XSS Payload Crafting and WAF Bypass: A Beginner-Friendly Guide beginner | XSS Payload Crafting and WAF Bypass: A Beginner-Friendly Guide |
| 2026-04-10 2026 | Bypassing WAFs for Fun and JS Injection with Parameter Pollution intermediate 10 min read | Tool for bypassing WAFs using ASP.NET's HTTP parameter pollution for JavaScript injection. This technique abuses how ASP.NET concatenates duplicate parameters with commas to construct valid JavaScript payloads that evade signature-based and machine learning WAFs by splitting malicious code across multiple parameters, exploiting inconsistencies in how WAFs parse parameters versus how the ASP.NET framework and JavaScript interpreter process them. |
| 2026-04-10 2026 | XSS Filter Evasion: How Attackers Bypass XSS Filters intermediate 15 min read | Technique for bypassing cross-site scripting (XSS) filters by exploiting browser parsing quirks and encoding methods. Attackers leverage HTML event handlers, JavaScript syntax variations, and malformed HTML to execute malicious scripts, as simple pattern matching and blacklisting prove insufficient. Techniques like URL encoding and HTML entity encoding are used to disguise payloads, making them undetectable by basic filters, and highlighting the necessity of layered security beyond just filtering. → acunetix.com |
| 2026-04-10 2026 | WAF XSS Bypass: Obfuscation and Encoding Techniques intermediate | Library of techniques for bypassing Web Application Firewalls (WAF) and obfuscating Cross-Site Scripting (XSS) payloads. It includes guides on common encoding and obfuscation methods to mask malicious content and lists various WAF bypass strategies with examples, detailing how attackers defeat WAF defenses. |
| 2026-04-10 2026 | WAF Bypass XSS Payloads Collection intermediate | WAF Bypass XSS Payloads Collection |
| 2026-04-10 2026 | CVE-2026-0594: Reflected XSS in WordPress news 9 min read | CVE-2026-0594 is a reflected XSS vulnerability in the WordPress "List Site Contributors" plugin. Attackers can inject malicious JavaScript through shortcode parameters or AJAX requests, leading to session hijacking, privilege escalation, or site defacement. This vulnerability affects plugin versions 1.0 through 1.2.3, is unauthenticated, and can be exploited via the network. |
| 2026-04-10 2026 | TrustyMon: Practical Detection of DOM-based XSS Using Trusted Types advanced | TrustyMon: Practical Detection of DOM-based XSS Using Trusted Types → dl.acm.org |
| 2026-04-10 2026 | CVE-2025-67906: MISP Stored XSS via Workflow Engine news 8 min read | Writeup of CVE-2025-67906 details a Stored Cross-Site Scripting (XSS) vulnerability in MISP versions up to 2.5.27, stemming from unsanitized workflow trigger names rendered via the doT.js template engine. An authenticated attacker can inject HTML/JavaScript into the `name` field of workflow triggers, which is then executed in the browser of any user viewing that workflow. This allows for session hijacking, data exfiltration, and credential harvesting, with payloads bypassing Content Security Policy by using `window.location` for data exfiltration. |
| 2026-04-10 2026 | How I Hacked a Web App Using Stored XSS to Steal Sessions intermediate 3 min read | Writeup detailing a stored XSS exploit against a web application, leading to admin session theft and account takeover. The exploit leveraged an unescaped bio field to inject JavaScript, targeting an admin who routinely reviewed user profiles. Crucially, the application lacked Content Security Policy, had non-HttpOnly cookies, and failed to properly encode user-generated content in support ticket comments and profile bios, allowing for critical vulnerabilities like performing admin actions and creating new admin accounts via alternative payloads. |
| 2026-04-10 2026 | 10 Practical Scenarios for XSS Attacks beginner 17 min read | Scenarios illustrate practical XSS attacks, detailing reflected, persistent, and DOM-based vulnerabilities. The content focuses on exploiting web applications, including techniques for session hijacking by stealing cookies via JavaScript payloads, and shows how to craft malicious payloads using examples like injecting `<script>alert(document.cookie)</script>` into vulnerable parameters within DVWA. |
| 2026-04-10 2026 | Reflected XSS: Advanced Exploitation Guide advanced 10 min read | Guide to hunting and exploiting reflected XSS vulnerabilities. This guide details a three-step methodology for identifying reflection points, testing for injection possibilities by breaking out of HTML or JavaScript contexts, and crafting proof-of-concept payloads. It covers generic HTML, HTML attribute, and JavaScript contexts, offering examples such as `<script>alert(1)</script>` and `<img src=x onerror=alert(1)>`, and explains how to handle filtered inputs. The resource also distinguishes reflected XSS from stored XSS and DOM-based XSS. → intigriti.com |