The newest Cross-Site Scripting (XSS) resources are on the Cross-Site Scripting (XSS) page. For a reading order instead of a date order, see the Cross-Site Scripting (XSS) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-10 2026 | Weaponizing Cross Site Scripting: When One Bug Isn't Enough advanced 4 min read | Technique guide detailing how Cross-Site Scripting (XSS) can be weaponized by chaining it with vulnerabilities like open redirects, CSRF, weak CSP, insecure JSON logging leading to account takeover, file upload flaws for RCE, abusing administrative functions, and improper `postMessage` usage causing token leakage. It emphasizes that XSS rarely exists in isolation and attackers combine multiple weaknesses to escalate impact, making layered defenses crucial. → microsoft.com |
| 2026-04-10 2026 | XSS Exploitation in 2025: Advanced Techniques, AI Integration, and Evasion Strategies advanced | XSS Exploitation in 2025: Advanced Techniques, AI Integration, and Evasion Strategies |
| 2026-04-10 2026 | XSS Attacks: From Basics to Advanced Post-Exploitation (2025 Edition) intermediate 22 min read | Library for mastering Cross-Site Scripting (XSS) attacks, covering fundamental concepts to advanced post-exploitation techniques. It details Stored XSS, Reflected XSS, and DOM-Based XSS, alongside manual and automated testing methods using tools like XSStrike, Dalfox, and KXSS. The guide explores filter bypasses, crafting advanced payloads, and exploitation scenarios including cookie stealing and session hijacking. It also addresses XSS prevention for developers, CSP bypasses, and integrating XSS with tools like BeEF for chained attacks. |
| 2026-04-10 2026 | Discovering and Exploiting XSS Vulnerabilities — My First Bug Hunting Reward beginner | Discovering and Exploiting XSS Vulnerabilities — My First Bug Hunting Reward |
| 2026-04-10 2026 | How I Found a Critical XSS On a Public Bug Bounty Program intermediate | How I Found a Critical XSS On a Public Bug Bounty Program |
| 2026-04-10 2026 | BugBounty Hunting for XSS in 2025 beginner | BugBounty Hunting for XSS in 2025 |
| 2026-04-10 2026 | Apple Developer Stored XSS — $5,000 Bounty Writeup intermediate | Apple Developer Stored XSS — $5,000 Bounty Writeup |
| 2026-04-06 2026 | Browser-Based Attacks in 2026: What Every Startup Needs to Know beginner 11 min read | Guide to 2026 browser-based attacks, detailing threats like ClickFix, AITM phishing (Tycoon 2FA), and malicious OAuth apps (ConsentFix). It highlights how these attacks bypass traditional security, exploiting user trust and evolving tactics to steal credentials and session tokens through methods like infostealer malware (LummaStealer) and compromised browser extensions. The guide also covers session hijacking, malicious file delivery, and the critical vulnerability of SaaS applications and internal tools to such exploits. |
| 2026-04-06 2026 | CVE-2025-1647: Bootstrap 3 XSS Vulnerability via DOM Clobbering news 6 min read | Writeup on CVE-2025-1647, a medium-severity XSS vulnerability in Bootstrap 3's Tooltip and Popover components. The flaw leverages DOM clobbering to bypass HTML sanitization, enabling script execution. Versions 3.4.1 through 3.x are affected, and due to Bootstrap 3 being end-of-life, HeroDevs offers NES for Bootstrap v3.4.7 as a remediated drop-in replacement, resolving this and other known Bootstrap 3 CVEs. |
| 2026-04-06 2026 | CVE-2026-32629: phpMyFAQ XSS Vulnerability news 4 min read | Writeup of CVE-2026-32629 in phpMyFAQ details a stored Cross-Site Scripting (XSS) vulnerability exploitable by unauthenticated attackers. Malicious HTML and JavaScript can be injected via crafted email addresses within RFC 5321 quoted local parts. This bypasses PHP validation and sanitization, leading to persistent XSS execution in admin sessions due to the unsafe use of Twig's `|raw` filter when rendering email addresses. Versions prior to 4.1.1 are affected. → sentinelone.com |
| 2026-04-06 2026 | Cross-site leaks (XS-Leaks) - Security - MDN Web Docs intermediate 10 min read | Guide to Cross-site Leaks (XS-Leaks), a class of attacks where an attacker's site derives information about a target site or user by leveraging web platform APIs. This guide details techniques such as leaking page existence via error events, frame counting using window references, and detecting redirects with Content Security Policy (CSP), illustrating how these attacks can reveal user login status or sensitive information. It explains the common underlying weaknesses that enable these exploits and offers general defenses against them. |
| 2026-04-06 2026 | Site-DOM-XSS using Cookie Injection: The AI Hackers are Coming intermediate | Site-DOM-XSS using Cookie Injection: The AI Hackers are Coming |
| 2026-04-03 2026 | Awesome Bug Bounty Writeups - Curated List by Bug Type beginner 19 min read Bug Bounty | Library of curated bug bounty writeups detailing successful exploitation of vulnerabilities including Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), SQL injection, and Server-Side Request Forgery (SSRF). Entries cover specific bypass techniques for WAFs, filter evasion methods, and numerous real-world examples from major vendors like Google, Microsoft, Facebook, and Amazon, often detailing the path to account takeover or remote code execution. |
| 2026-04-03 2026 | XSS Exploit Payloads - DOM, Reflected, Stored, and WAF Bypass intermediate 33 min read | Library of curated, battle-tested Cross-Site Scripting (XSS) exploit payloads. This repository offers a collection of effective techniques for exploiting DOM-based, reflected, and stored XSS vulnerabilities, including various methods for bypassing Web Application Firewalls (WAFs). The payloads cover a range of attack vectors, such as JavaScript `prompt()`, `eval()`, and event handler exploitation within HTML elements like `<img>`, `<svg>`, and `<iframe>`. |
| 2026-04-03 2026 | Stored XSS Vulnerability WAF Bypass Writeup intermediate | Stored XSS Vulnerability WAF Bypass Writeup |
| 2026-04-03 2026 | Reflected XSS with WAF Bypass — A Creative Payload That Worked intermediate | Reflected XSS with WAF Bypass — A Creative Payload That Worked |
| 2026-04-03 2026 | DOM-Based XSS in Single Page Applications (SPAs): A Complete Guide intermediate | DOM-Based XSS in Single Page Applications (SPAs): A Complete Guide |
| 2026-04-03 2026 | The Ultimate Guide to Finding and Escalating XSS Bugs | Bugcrowd intermediate | The Ultimate Guide to Finding and Escalating XSS Bugs | Bugcrowd → bugcrowd.com |
| 2026-04-03 2026 | How a Cross-Site Scripting Vulnerability Led to Account Takeover | HackerOne intermediate 4 min read | Writeup detailing how a reflected XSS vulnerability on yelp.com, stemming from unescaped cookie values and a cookie parsing issue, enabled account takeovers. The vulnerability allowed for persistent XSS payloads, simulated credential theft via a keylogger, and facilitated linking external accounts. Remediation involved validating and sanitizing user input, and removing the ability to set cookies via query parameters. → hackerone.com |
| 2026-04-03 2026 | XSS Attacks & Exploitation: The Ultimate Guide | YesWeHack intermediate 12 min read | Guide to XSS attacks and exploitation, covering reflected, stored, and DOM variants. It details detection methods, exploitation techniques, and real-world scenarios, emphasizing why mastering XSS, CWE-79, is crucial for bug bounty hunters and ethical hackers. The guide explains how to leverage user input to inject malicious JavaScript, leading to session hijacking, account takeovers, and data exfiltration. It also explores chaining vulnerabilities like CSRF with authenticated reflected XSS for greater impact, and discusses payload obfuscation for stored XSS. → yeswehack.com |
| 2026-04-03 2026 | Cross-Site Scripting (XSS) Cheat Sheet - 2026 Edition | PortSwigger intermediate 16 min read | Cheatsheet detailing Cross-Site Scripting (XSS) vectors, regularly updated and featuring bypass techniques for WAFs and filters. It categorizes vectors by event handlers, tags, and browser compatibility, including proof-of-concept code for numerous scenarios such as JavaScript hoisting, file upload restrictions, and bypassing specific browser limitations with techniques like exception handling and template strings. → portswigger.net |
| 2026-03-26 2026 | Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website news 2 min read | Library for securing AI browser extensions, this analysis details the ShadowPrompt vulnerability (CVE-2025-XXXX) in Anthropic's Claude Chrome Extension. The flaw exploited an overly permissive origin allowlist combined with a DOM-based XSS vulnerability in an Arkose Labs CAPTCHA component, enabling zero-click prompt injection and potential data theft. A patch has since been deployed. → thehackernews.com |
| 2026-03-26 2026 | CISA and FBI release secure-by-design guidelines on cross-site scripting beginner 3 min read | Alert from CISA and FBI providing secure-by-design guidelines to eliminate cross-site scripting (XSS) vulnerabilities. The alert details how XSS exploits user trust, enabling session hijacking, data theft, and malware installation, referencing past attacks like the ResumeLooters breach and the Fortnite incident. It advocates for proactive measures including input validation, output encoding, and Content Security Policies (CSP), aligning with broader secure-by-design principles for developers to build security into applications from inception. → ibm.com |
| 2026-03-21 2026 | PolyShell flaw exposes Magento and Adobe Commerce to file upload attacks news 2 min read | Library for identifying and mitigating the PolyShell vulnerability in Magento and Adobe Commerce REST APIs. This critical flaw allows unauthenticated attackers to upload executable files, potentially leading to RCE or account takeover. The vulnerability has existed since Magento 2's initial release and impacts versions up to 2.4.9-alpha2, with affected releases prior to 2.3.5 also susceptible to XSS. While a fix exists in the 2.4.9 pre-release, no standalone patch is available for production versions, necessitating real-time WAF blocking and strict server configurations to protect upload directories. → securityaffairs.com |
| 2026-03-20 2026 | Magento PolyShell Flaw Enables Unauthenticated Uploads RCE and Account Takeover intermediate 3 min read | Library for securing Magento, addressing the PolyShell vulnerability (CVE-2026-XXXX) that allows unauthenticated arbitrary file uploads to achieve RCE or account takeover. This critical flaw, affecting Magento Open Source and Adobe Commerce up to 2.4.9-alpha2, exploits the REST API's handling of custom options with file types by writing uploaded data to `pub/media/custom_options/quote/`. Exploitation involves disguised polyglot files that embed executable PHP code within image formats, leading to web shells and password-protected RCE shells. Mitigation strategies include restricting access to the upload directory and implementing web server rules to block access. → thehackernews.com |
| 2026-03-19 2026 | Russian APT targets Ukraine via Zimbra XSS flaw CVE-2025-66376 news 2 min read | Writeup of CVE-2025-66376, a stored XSS vulnerability in Zimbra Collaboration exploited by Russian APT groups targeting Ukraine. The flaw, with a CVSS score of 7.2, allowed attackers to execute scripts via specially crafted HTML emails, enabling credential theft, session token compromise, and mailbox data exfiltration. Nation-state actors, potentially APT28, leveraged this vulnerability, dubbed Operation GhostMail, to target entities including Ukraine's State Hydrology Agency. Synacor has since released patches, and CISA has added CVE-2025-66376 to its Known Exploited Vulnerabilities catalog. → securityaffairs.com |
| 2026-03-19 2026 | Russian APT Exploits Zimbra Vulnerability Against Ukraine news 2 min read | Writeup detailing CVE-2025-66376, a stored XSS vulnerability in Zimbra Collaboration's Classic UI, exploited by Russian APT28 (Forest Blizzard) in attacks against Ukraine. This flaw, addressable via CSS @import directives in email HTML, allows for credential theft, session token exfiltration, and mailbox data extraction. CISA has added this vulnerability to its KEV catalog, mandating patches for federal agencies. → securityweek.com |
| 2026-03-18 2026 | CISA orders feds to patch Zimbra XSS flaw exploited in attacks news 2 min read | Writeup of CVE-2025-66376, a stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite's Classic UI. Exploitable via malicious HTML emails, this flaw allows remote unauthenticated attackers to execute arbitrary JavaScript, potentially hijacking sessions and stealing data. CISA mandated federal agencies patch this actively exploited flaw, which has seen prior exploitation of Zimbra vulnerabilities by groups like Winter Vivern. → bleepingcomputer.com |
| 2026-03-14 2026 | Persistent XSS/RCE using WebSockets in Storybooks dev server news 6 min read | Library of JavaScript code and examples addressing CVE-2026-27148, a high-severity WebSocket hijacking vulnerability in Storybook's dev server. This vulnerability can lead to persistent Cross-Site Scripting (XSS) and Remote Code Execution (RCE) by allowing attackers to inject malicious code into story files. Exploitation can occur via publicly exposed dev servers or through a malicious webpage visited by a developer running a local instance, potentially compromising credentials, system access, and network resources, and even propagating through version control and CI/CD pipelines. → aikido.dev |
| 2026-02-25 2026 | XSS Bug in VS Code Extension Exposed Local Files news 3 min read | Writeup on a cross-site scripting (XSS) vulnerability in the official Live Preview VS Code extension, impacting versions up to 0.4.16. This flaw allowed malicious websites to enumerate local files and exfiltrate sensitive data, including API keys and source code, by exploiting improper input sanitization in the extension's embedded HTTP server. Mitigation strategies include updating the extension, disabling non-essential plugins, implementing host firewalls, and utilizing secure secret management. → esecurityplanet.com |
| 2026-02-11 2026 | FortiSandbox XSS Vulnerability Allows Remote Command Execution news 2 min read | Writeup detailing CVE-2025-52436, a reflected XSS vulnerability in FortiSandbox's web interface that allows unauthenticated remote command execution. Insufficient input sanitization enables attackers to inject malicious JavaScript, which, when rendered by a privileged user, can grant command-line access to the underlying system. Affected versions require prompt patching or migration, and mitigation strategies include access restrictions, WAF deployment, log monitoring, and incident response planning. → esecurityplanet.com |
| 2026-02-06 2026 | DOM Invader beginner 1 min read | Tool for testing DOM XSS vulnerabilities, DOM Invader is an extension preinstalled in Burp's browser. It aids in identifying controllable sinks, logging and modifying `postMessage` calls for web message DOM XSS, and automatically detecting prototype pollution and DOM clobbering vulnerabilities. Its configurable nature allows for fine-tuning to suit various websites and use cases. → portswigger.net |
| 2026-02-06 2026 | bjrjk/js-vuln-studies: A collection of in-depth studies authored by me on JavaScript engine vulnerabilities. advanced | A collection of in-depth studies authored by me on JavaScript engine vulnerabilities. - bjrjk/js-vuln-studies |
| 2026-02-01 2026 | TrinetLayer advanced | A battle-tested TrinetLayer for vulnerability research, real-world exploit payloads, and modern attack techniques — crafted by hackers, trusted by hackers. |
| 2026-01-27 2026 | XSS in Live Preview Microsoft VS Code Extension with 11M Downloads news 4 min read | Writeup of an XSS vulnerability in the Microsoft VS Code Live Preview extension, affecting over 11 million users. The vulnerability allowed remote attackers to exfiltrate local files, including sensitive credentials and API keys, by exploiting the extension's embedded HTTP server. The issue, which enabled data exfiltration, was responsibly disclosed to Microsoft and patched in version 0.4.16. → ox.security |
| 2026-01-22 2026 | Testing for reflected XSS manually with Burp Suite intermediate 1 min read | Library for testing reflected XSS with Burp Suite's Repeater. This method involves identifying HTTP requests that reflect user input and then manipulating those requests to inject proof-of-concept XSS payloads. The technique focuses on input validation and server-side sanitization, utilizing Burp Repeater to directly modify requests and observe the immediate response for successful payload execution within HTML contexts, such as the example `alert()` function. → portswigger.net |
| 2026-01-21 2026 | Testing for stored XSS with Burp Suite intermediate 2 min read | Library for manually testing stored XSS vulnerabilities using Burp Suite. It details identifying input and output points by submitting unique values and filtering HTTP history, then using Repeater to send proof-of-concept payloads like `<script>alert(1)</script>` to test for execution. → portswigger.net |
| 2026-01-19 2026 | Bypassing XSS filters by enumerating permitted tags and attributes intermediate 2 min read | Tool for bypassing XSS filters by enumerating permitted HTML tags and attributes. Utilizing Burp Intruder, this method systematically tests potential tags and attributes that an application might allow, revealing which elements are not filtered. This technique is particularly useful when standard proof-of-concept XSS payloads fail, enabling the construction of effective XSS attacks against applications with input validation mechanisms. → portswigger.net |
| 2026-01-19 2026 | Critical XSS Vulnerability in StealC Malware Admin Panel Allows Researchers to Infiltrate and Monitor Threat Actor Operations news 5 min read | Writeup of a persistent XSS vulnerability in the StealC malware admin panel, version 2.0, which allowed researchers to infiltrate and monitor threat actor operations. Exploitation led to the exfiltration of session cookies and system fingerprints from operators like YouTubeTA, revealing their location and hardware. The flaw enabled the observation of live sessions, stolen data, and malware management, demonstrating that even criminal infrastructure is susceptible to common web application vulnerabilities. → rescana.com |
| 2026-01-19 2026 | TrinetLayer intermediate | TrinetLayer is a proven tool used for vulnerability research, real-world exploit payloads, and modern attack techniques. It is created by hackers and is widely trusted within the hacker community for its effectiveness. |
| 2026-01-18 2026 | Account Takeover in Facebook mobile app due to usage of cryptographically unsecure random number generator and XSS in Facebook JS SDK intermediate 11 min read Mobile | Library for analyzing the Facebook JavaScript SDK, detailing how a DOM-based XSS vulnerability in the Customer Chat plugin, stemming from unescaped `iconSVG` injection, can be exploited. The exploit is made possible by an account takeover scenario facilitated by a weak cryptographic primitive: `Math.random()` used for generating callback identifiers, which are then exposed via `window.name` of plugin iframes and can be predicted after forcing reinitialization of the SDK. |
| 2026-01-17 2026 | Testing for DOM XSS with DOM Invader intermediate 1 min read | Tool for testing DOM-based XSS vulnerabilities, DOM Invader injects unique strings into untrusted data sources and identifies controllable sinks where data is written unsafely to the DOM. It simplifies manual JavaScript analysis by visualizing data flow, enabling testers to efficiently locate and exploit DOM XSS flaws within applications, particularly by analyzing `document.write` sinks and `location.search` sources. → portswigger.net |
| 2026-01-15 2026 | CISAs secure-software buying tool had a simple XSS vulnerability of its own news 2 min read | Writeup of a cross-site scripting (XSS) vulnerability in CISA's "Software Acquisition Guide: Supplier Response Web Tool." The flaw, discovered by OWASP former leader Jeff Williams, allowed for JavaScript injection and potential website defacement. While CISA addressed and patched the vulnerability, its discovery highlighted potential gaps in basic security testing for tools intended to promote secure software development. → cyberscoop.com |
| 2026-01-04 2026 | XSSNow - The Ultimate XSS Payload Database beginner | The content provided is a link to XSSNow, which is described as the Ultimate XSS Payload Database. The website likely contains a comprehensive collection of cross-site scripting (XSS) payloads that can be used for testing and research purposes. XSS vulnerabilities are a common security issue on websites, and having access to a database of payloads can help security professionals and developers better understand and mitigate these risks. The link provided likely leads to a resource that can assist in testing and securing web applications against XSS attacks. |
| 2026-01-01 2026 | CVE-2025-23469 Impact Exploitability and Mitigation Steps news | The content discusses the CVE-2025-23469 vulnerability, focusing on its impact, exploitability, and mitigation steps. It provides insights into the potential consequences of the vulnerability, the likelihood of it being exploited, and steps that can be taken to mitigate the risks associated with it. The link provided directs to further details on the vulnerability in the Wiz vulnerability database. → wiz.io |
| 2025-12-23 2025 | Turning List-Unsubscribe into an SSRF/XSS Gadget intermediate 6 min read SSRF | Library detailing exploitation of the `List-Unsubscribe` SMTP header. This header, intended for email list management, can be abused to trigger Cross-Site Scripting (XSS) via JavaScript URIs, as demonstrated with Horde Webmail (CVE-2025-68673). It can also facilitate Server-Side Request Forgery (SSRF) when email clients initiate unsubscription requests server-side, exemplified by Nextcloud Mail App under specific configuration. |
| 2025-12-17 2025 | JS-Tap: Weaponizing JavaScript for Red Teams🔴 advanced | https://t.co/m2sW71WuH0 |
| 2025-11-30 2025 | CISA Adds Actively Exploited XSS Bug CVE-2021-26829 in OpenPLC ScadaBR to KEV news 3 min read | Library for securing OpenPLC ScadaBR, addressing CVE-2021-26829 (XSS) and CVE-2021-26828 (unrestricted file upload), both listed on CISA's Known Exploited Vulnerabilities (KEV) catalog due to active exploitation by groups like TwoNet. These vulnerabilities impact Windows and Linux versions, with exploitation involving defacing HMI pages, disabling logs, and uploading web shells. The article also details Out-of-Band Application Security Testing (OAST) infrastructure used to fuel regional exploit operations. → thehackernews.com |
| 2025-11-12 2025 | Is It CitrixBleed4? Well No. Is It Good? Also No. (Citrix NetScaler Memory Leak & RXSS CVE-2025-12101) news 5 min read | Writeup detailing CVE-2025-12101, a reflected XSS vulnerability found in Citrix NetScaler's SAML RelayState parameter. The analysis also covers an undocumented memory leak (WT-2025-0089) triggered by a specific AAA virtual server misconfiguration, noting the ongoing fragility of memory management in these appliances. → labs.watchtowr.com |
| 2025-11-10 2025 | CVE-2025-31029 Impact Exploitability and Mitigation Steps news | Writeup detailing CVE-2025-31029, an impact exploitability and mitigation analysis. This community-led vulnerability database entry provides insights into a critical cloud security issue, enabling users to evaluate their practices across nine security domains and identify defensive gaps. → wiz.io |