Attacks Dictionary
Cross-site scripting (XSS)
Definition
Cross-site scripting (XSS) injects malicious JavaScript into pages that other users’ browsers will run.
Also called: XSS, cross-site scripting, cross site scripting
Why it matters for WordPress
Stored XSS in a comment, page builder field, or admin notice can run in another user’s browser. For admins, that can mean stolen cookies, forced actions, or malware shown to visitors. Reflected XSS often rides on crafted URLs in plugins.
How it shows up in practice
- Unexpected popups, redirects, or injected ads on the front end
- Admin screens that behave oddly after viewing crafted content
- Scanner or CVE notes mentioning reflected or stored XSS in a plugin
What to do
- Update vulnerable plugins and themes quickly.
- Limit who can publish unfiltered HTML.
- Sanitize and escape output in custom themes and plugins.
- Use a content security policy where practical (hosting or edge).
- Treat odd JavaScript on your pages as an incident: scan, review recent content, check users.
Full guide: WordPress XSS attacks.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- CSRF CSRF tricks a logged-in browser into sending a request the user did not mean to send.
- Session hijacking Session hijacking steals or guesses a valid session so the attacker acts as the logged-in user.
- Vulnerability A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- WordPress nonce A WordPress nonce is a short-lived token used to verify that a request was intentional, mainly to reduce CSRF risk.
