XSS statistics show cross-site scripting is the most reported web weakness in vulnerability data and one of the least exploited: 8,671 CVEs published in 2025 mention cross-site scripting, up 172% from 3,189 in 2022, and MITRE’s 2025 list ranks it the first most dangerous software weakness. Yet CISA’s catalog of exploited vulnerabilities holds only 33 XSS flaws, 4 of them added in 2026, and 17 of the 33 sit in email and webmail products. Those numbers count different things. A published CVE, a tested application, an attack attempt, an exploited vulnerability and a confirmed breach are five different units, and most of the XSS statistics quoted online mix them or rely on a counting method that misses most XSS records. This research keeps each unit separate, shows how ScanTitan counted from public data, labels vendor figures as vendor-only, and says where a popular number does not hold up. Data last checked: 9 November 2026.
Key XSS Statistics for 2026
Executive Benchmark: XSS Statistics for 2026
| Metric | Latest figure | Period | Trend / context | Source |
|---|---|---|---|---|
| CVEs mentioning XSS | 8,671 | 2025 | 3,189 in 2022; 7,366 in 2024; 17.4% of all CVEs | NVD API, counted by ScanTitan |
| CVEs mentioning XSS | 7,389 | 1 Jan to 7 Nov 2026 | 2026 total CVEs are 95,671, almost double 2025 | NVD API, counted by ScanTitan |
| Rank in the CWE Top 25 | #1, score 60.38 | 2025 list | #1 in 2020 and 2024; #2 in 2019, 2021, 2022 and 2023 | MITRE |
| CWE Top 25 KEV CVEs for CWE-79 | 7 | Jun 2024 to Jun 2025 window | 3 in the 2024 list; 4 in 2023; 2 in 2022 | MITRE |
| OWASP injection category | #5, 62,445 CVEs | OWASP Top 10:2025 | XSS is more than 30,000 of them; high frequency, low impact | OWASP |
| Exploited XSS flaws in KEV | 33 | Catalog version 2026.11.06 | 4 added in 2026, 7 in 2025; 5 with known ransomware use | CISA KEV feed, counted by ScanTitan |
| KEV XSS flaws in email and webmail products | 17 of 33 (52%) | Catalog version 2026.11.06 | Zimbra 9, Roundcube 6, MDaemon 1, Exchange 1 | CISA KEV feed, counted by ScanTitan |
| XSS share of Microsoft’s important or critical cases | 15% | July 2024 to July 2025 | 265 XSS cases, 2 rated Critical; vendor-only | Microsoft MSRC |
| XSS share of observed attack traffic | 40% | Q1 2025 | 35% in Q1 2024; vendor-only | Fastly |
| Stored and reflected XSS in critical and high web findings | 10.80% and 6.21% | Edgescan 2025 edition | SQL injection is 28.28%; vendor-only | Edgescan 2025 report |
| Security pass rate for XSS in AI-generated code | 18% (mean) | October 2026 | 15% in July 2026; vendor-only | Veracode |
| WordPress CVEs that also mention XSS | 1,922 | 1 Jan to 7 Nov 2026 | 1,853 in 2025; 108 in 2020 | NVD API, counted by ScanTitan |
Methodology: What Counts as XSS Statistics?
“XSS statistics” is used for five different measurements. Each answers a different question, comes from a different kind of source, and can be wrong in a different way.
| Unit | What it counts | Example 2026 figure | Source type | What it cannot tell you |
|---|---|---|---|---|
| CVE record | A published vulnerability whose description mentions cross-site scripting | 8,671 CVEs mention it in 2025 | Public vulnerability database | How many applications or sites are affected |
| Tested application | An application found vulnerable when scanned or tested | 10.80% stored XSS in critical and high findings (Edgescan) | Testing data from vendors | How many applications exist, or whether they were attacked |
| Attack attempt | A request that looks like XSS at a firewall | 40% of observed attack traffic (Fastly, Q1 2025) | Vendor traffic data | Whether the attack succeeded |
| Exploited vulnerability | A flaw with reliable evidence of exploitation | 33 entries in CISA’s catalog | Government catalog | How many organizations were hit |
| Confirmed breach | An incident with confirmed data disclosure | No current neutral count (see below) | Incident data | Which technique, unless the source records it |
How ScanTitan counted. The CVE figures come from the National Vulnerability Database API, queried on 9 November 2026 in 90-day windows by publication date. We downloaded every record whose text contains “XSS” or “scripting” and counted the CVEs whose English description matches “cross-site scripting,” “cross site scripting” or the word “XSS.” This is the description count. A search for the exact phrase “cross-site scripting” alone returns far fewer records (3,755 for 2025) because many descriptions say only “XSS.” The tag count is the number NVD’s API returns for the CWE-79 weakness filter, and it is not a usable trend: the filter returns only the tag NVD itself assigns, and most CVEs carry only the tag their publisher supplied. In a sample of 1 to 14 June 2025, 470 CVEs mention XSS and 30 are in the filter. For all of 2025 the filter returns 875 CVEs against 8,671 by description, so any statistic built on that filter understates XSS by about nine tenths.
Source confidence. MITRE and OWASP are non-profit and publish their methods. CISA’s catalog is a floor of confirmed exploitation, not a census. Microsoft, Fastly, Edgescan and Veracode describe their own cases, traffic, customers and tests, so their figures are labeled vendor-only. Verizon’s 2026 DBIR does not mention cross-site scripting at all, so there is no breach count for XSS from that report.
How Many XSS Vulnerabilities Are Published Each Year?
| Year | CVEs mentioning XSS | All CVEs published | Share |
|---|---|---|---|
| 2020 | 2,053 | 19,222 | 10.7% |
| 2021 | 2,531 | 21,950 | 11.5% |
| 2022 | 3,189 | 26,431 | 12.1% |
| 2023 | 4,891 | 30,949 | 15.8% |
| 2024 | 7,366 | 40,704 | 18.1% |
| 2025 | 8,671 | 49,972 | 17.4% |
| 2026 to 7 Nov | 7,389 | 95,671 | 7.7% |
Source: NVD API, queried 9 November 2026 and counted by ScanTitan.
Three readings matter. First, the count has grown every year: up 172% from 2022 to 2025 and 4.2 times from 2020, with 2025 up 17.7% on 2024. Second, the share of all CVEs rose from 10.7% to a peak of 18.1% in 2024 and eased to 17.4% in 2025, so roughly one in six CVEs now mentions XSS. Third, 2026 is unusual: NVD recorded 95,671 CVEs by 7 November, almost double 2025, so the 7.7% share reflects a much larger denominator, not fewer XSS flaws. The 7,389 XSS CVEs already published in 2026 are 85% of the 2025 total with almost two months left. In 2025, XSS CVEs were 2.2 times the 3,904 that mention SQL injection; see ScanTitan’s SQL injection statistics for that count.
What types of XSS do the descriptions name?
NVD descriptions often name the type. Of the 8,671 XSS CVEs published in 2025, 4,476 (51.6%) describe stored or persistent XSS, 1,820 (21.0%) describe reflected XSS and 413 (4.8%) describe DOM-based XSS, and the rest name no type. A description can name more than one type, so the shares do not add to a total. Stored XSS is mentioned about 2.5 times as often as reflected XSS, which fits how many of these flaws are reported: content saved by one user and shown to another, such as a plugin setting or a comment field.
XSS in the CWE Top 25 and OWASP Top 10
MITRE CWE Top 25
| List year | Rank | Score | KEV CVEs for CWE-79 in the window |
|---|---|---|---|
| 2019 | 2 | 45.69 | Not listed |
| 2020 | 1 | 46.82 | Not listed |
| 2021 | 2 | 46.84 | Not listed |
| 2022 | 2 | 45.97 | 2 |
| 2023 | 2 | 45.54 | 4 |
| 2024 | 1 | 56.92 | 3 |
| 2025 | 1 | 60.38 | 7 |
Source: MITRE CWE Top 25 archive pages for 2019 to 2025. MITRE’s score combines how often a weakness is mapped to a CVE with the average severity of those CVEs. In 2025 SQL injection ranked second (28.72) and cross-site request forgery third (13.64).
XSS has been first or second in every list since 2019. Its 2025 score of 60.38 is the highest in the series and more than double the second-ranked weakness, which tells you how many CVEs map to it, not that each one is severe.
OWASP Top 10
OWASP folded XSS into its Injection category. In the 2025 list, A05 Injection has 62,445 mapped CVEs across 37 CWEs, and OWASP puts cross-site scripting at more than 30,000 of them against more than 14,000 for SQL injection. OWASP calls XSS “high frequency, low impact” and says the large number of CWE-79 CVEs brings down the category’s average weighted impact. Its 2021 list placed Injection third and its 2025 list fifth. Sources: OWASP Top 10:2025 A05 and OWASP Top 10:2021 A03.
Exploited in the Wild: CISA’s Known Exploited Vulnerabilities
ScanTitan counted the CISA catalog’s weakness tags in feed version 2026.11.06, which lists 1,769 entries.
| KEV XSS measure | Count |
|---|---|
| Entries tagged CWE-79 | 33 (1.9% of the catalog) |
| Added in 2021 | 3 |
| Added in 2022 | 8 |
| Added in 2023 | 6 |
| Added in 2024 | 5 |
| Added in 2025 | 7 |
| Added in 2026 to 6 November | 4 |
| With known ransomware campaign use | 5 (15%) |
| In email and webmail products | 17 (52%) |
Source: CISA KEV feed, counted by ScanTitan.
This is the gap at the center of the research. XSS is 17.4% of CVEs in 2025 and 1.9% of the exploited catalog. Most XSS flaws need a victim to load a crafted page or message, which fits the pattern: the exploited ones cluster in products where an email can carry the attack. Synacor Zimbra Collaboration Suite has 9 entries, Roundcube Webmail 6, MDaemon 1 and Microsoft Exchange Server 1, which is 17 of 33. All four of the 2026 additions are in that group.
XSS flaws added to KEV in 2026
| Date added | Vendor and product | CVE |
|---|---|---|
| 20 Feb | Roundcube Webmail | CVE-2025-68461 |
| 18 Mar | Synacor Zimbra Collaboration Suite | CVE-2025-66376 |
| 20 Apr | Synacor Zimbra Collaboration Suite | CVE-2025-48700 |
| 15 May | Microsoft Exchange Server | CVE-2026-42897 |
Source: CISA KEV feed. The five entries with known ransomware campaign use are two QNAP NAS flaws, two older Zimbra flaws and a Cisco ASA flaw, all added in 2021 or 2022.
XSS in WordPress and Other CMS
XSS is the weakness most often reported in WordPress plugins and themes. ScanTitan counted CVEs whose NVD descriptions mention WordPress, and how many of those also match XSS.
| Year | CVEs mentioning WordPress | Of which mention XSS | Share |
|---|---|---|---|
| 2020 | 256 | 108 | 42% |
| 2021 | 981 | 538 | 55% |
| 2022 | 1,660 | 799 | 48% |
| 2023 | 2,113 | 939 | 44% |
| 2024 | 4,483 | 2,322 | 52% |
| 2025 | 4,245 | 1,853 | 44% |
| 2026 to 7 Nov | 6,410 | 1,922 | 30% |
Source: NVD API, queried 9 November 2026 and counted by ScanTitan.
In 2025, 1,853 CVEs mention both WordPress and XSS. That is 21% of all 8,671 XSS CVEs that year and 44% of the 4,245 WordPress-related CVEs. The count fell from 2,322 in 2024, but the 1,922 recorded in 2026 to 7 November is already above the 2025 total. The XSS share of WordPress-related CVEs fell from 52% in 2024 to 30% in 2026 because other flaw types are being reported in much larger numbers, not because XSS declined. Most of these are plugin and theme flaws, not core. For plugin-level data, see ScanTitan’s WordPress plugin vulnerability statistics.
How Common Is XSS in Tested Applications?
No neutral source publishes how many applications are vulnerable to XSS. The best evidence is testing data from vendors, labeled here as vendor-only.
| Source | Finding | Period | Sample |
|---|---|---|---|
| Edgescan 2025 report | Stored XSS 10.80% and reflected XSS 6.21% of critical and high severity web and API findings, third and fourth behind SQL injection (28.28%) and malicious file upload (13.56%) | 2025 edition | Web and API layers; 14.8% of findings were critical or high |
| Microsoft MSRC | XSS was 15% of all important or critical cases; 265 XSS cases, 263 rated Important and 2 Critical; $912,300 paid in XSS bounties, top award $20,000 | July 2024 to July 2025 | Microsoft’s bounty and case data |
| Microsoft MSRC | More than 970 XSS cases mitigated | January 2024 to mid-2025 | Microsoft’s bounty and case data |
| Veracode | XSS (CWE-80) is the second weakest of four tested categories for AI-generated code: 15% passed in July 2026, 18% on average in October 2026 | July and October 2026 | 18 models, four languages, four weakness categories |
Sources: Edgescan 2025, Microsoft MSRC and Veracode. All vendor-only.
Three details matter. Edgescan lists XSS as two rows, stored and reflected, so quote each row or say “two rows”; together they are 17.01% of its top-ten table. Microsoft’s cases are mostly reports to its own services, so they show how a large vendor sees XSS, not how common it is across the web. Veracode’s pass rate means about four in five AI-generated samples failed the XSS test, which is far worse than the 83.7% pass rate for SQL injection in the same test. Veracode attributes the improvement from 15% to 18% to the simple, repeatable pattern of escaping output.
Attack Attempts: What Is Known
There is no neutral count of XSS attack attempts. The most recent figure we could verify comes from Fastly’s Q1 2025 report: XSS made up 40% of all observed attack traffic, up from 35% in Q1 2024, and Fastly says XSS and SQL injection have been the most prevalent attack methods for the past two years. Fastly’s data comes from its own customers’ traffic and counts observed attack requests, not successful attacks. Source: Fastly, vendor-only and from 2025. We did not find an XSS share in Fastly’s 2026 edition, which focuses on bots.
Breaches are the weakest unit. Verizon’s 2026 DBIR does not mention cross-site scripting, and no neutral source reports what share of breaches began with it. For the wider web picture, see ScanTitan’s web application attack statistics.
XSS Statistics Commonly Misquoted
| Common claim | Correct context |
|---|---|
| “XSS is 40% of all web attacks.” | Fastly’s share of its own observed attack traffic in Q1 2025, up from 35% a year earlier. Vendor-only, not all web attacks, and not breaches. |
| “NVD lists only 875 XSS CVEs for 2025.” | That is NVD’s own CWE-79 tag. NVD descriptions mention XSS in 8,671 CVEs in 2025. |
| “XSS is low risk, so it can wait.” | CISA lists 33 exploited XSS flaws, 5 with known ransomware use. Microsoft rated 2 of its 265 XSS cases Critical. |
| “XSS is the number one OWASP risk.” | XSS is part of Injection, ranked fifth in 2025. MITRE ranks XSS first. |
| “XSS is 17% of CVEs, so it causes 17% of attacks.” | A CVE count is not an attack count. XSS is 1.9% of CISA’s exploited catalog. |
| “AI code assistants have solved XSS.” | Veracode: 18% pass rate in October 2026, up from 15% in July. |
What the Numbers Mean for a Lean Team
Three facts shape the work: XSS is reported more than any other weakness, the exploited ones cluster in mail and web interfaces, and the fix is output encoding, not detection.
- Encode output by context. Treat untrusted data as text in HTML, attributes, JavaScript and URLs, and use the framework’s escaping by default. Prefer safe sinks such as textContent over innerHTML; Veracode notes that models pass the test far more often once they do.
- Add a Content Security Policy. It limits what an injected script can do. It reduces the damage of an XSS flaw but does not fix it.
- Patch mail and web interfaces first. The exploited XSS flaws are in Zimbra, Roundcube, MDaemon and Exchange. If you run webmail, put it on the patch list ahead of low-traffic plugins.
- Keep plugins and themes current. Most WordPress XSS reports are in plugins and themes. See the guide to the most common WordPress vulnerabilities.
- Scan on a schedule. A website vulnerability scanner can test for reflected and stored XSS, and the CVE priority checker shows whether a flaw is exploited.
- Know the neighbors. For how the attack works, read the guide to cross-site scripting. For the weakness that ranks second, see ScanTitan’s CMS vulnerability statistics and its vulnerability statistics.
How We Compiled and Verified These Statistics
- Used: the NVD API, CISA’s Known Exploited Vulnerabilities feed, MITRE’s CWE Top 25 archive, OWASP Top 10 pages for 2021 and 2025, Microsoft’s MSRC post of 4 September 2025, Fastly’s Q1 2025 report page, Edgescan’s 2025 report, Veracode’s Fall 2026 update and Verizon’s 2026 DBIR (full report, checked for XSS). Vendor figures are labeled vendor-only.
- Method: NVD records were downloaded on 9 November 2026 in 90-day windows by publication date, and descriptions were matched with a fixed pattern. KEV counts come from feed version 2026.11.06. Every other figure was read on its own page.
- Excluded: XSS counts built on the NVD CWE-79 filter, figures from competitor pages, an XSS attack share that conflicts with the vendor’s own earlier figure, and survey results from 2011 to 2018 that have no current equivalent.
- Refresh: reviewed every 90 days. NVD and KEV counts change daily; MITRE and OWASP update on their own cycles.
How to cite this research. ScanTitan, “XSS Statistics 2026: CVEs, Exploits, Attacks & Rankings,” 9 November 2026. For single figures, cite the primary source beside each number and state the NVD query date.
Primary Sources
- NVD CVE API
- CISA Known Exploited Vulnerabilities catalog data feed
- MITRE 2025 CWE Top 25
- OWASP Top 10:2025, A05 Injection and OWASP Top 10:2021, A03 Injection
- Microsoft MSRC, Why XSS still matters
- Fastly, AppSec in Q1 2025
- Edgescan 2025 Vulnerability Statistics Report
- Veracode, GenAI code security, Fall 2026
- Verizon 2026 Data Breach Investigations Report
Frequently Asked Questions
Is XSS still relevant today?
Yes. CVEs that mention XSS grew from 3,189 in 2022 to 8,671 in 2025, MITRE ranks it first in 2025, and Microsoft reports more than 970 XSS cases mitigated from January 2024 to mid-2025. Counts are for published vulnerabilities, not attacks.
How many XSS vulnerabilities are there each year?
ScanTitan’s count of NVD descriptions mentioning XSS was 2,053 in 2020, 3,189 in 2022, 7,366 in 2024 and 8,671 in 2025. NVD’s CWE-79 filter returns only 875 for 2025 because it counts just the tag NVD itself assigns.
What are the 3 most common types of XSS attacks?
The three types are stored, reflected and DOM-based XSS. In NVD descriptions for 2025, 52% of XSS CVEs name stored or persistent XSS, 21% name reflected XSS and 5% name DOM-based XSS; the rest name no type.
How common is XSS compared with SQL injection?
In 2025 about 8,671 CVEs mention XSS against 3,904 for SQL injection. In CISA’s exploited catalog both have 33 entries. MITRE ranks XSS first and SQL injection second in 2025.
How many XSS flaws are being exploited?
CISA’s catalog holds 33 entries tagged CWE-79, 1.9% of 1,769 entries. 17 are in email and webmail products, and 5 have known ransomware use. 4 were added in 2026.
Is XSS the number one OWASP risk?
No. XSS is part of the Injection category, which ranks fifth in OWASP’s 2025 list. MITRE’s CWE Top 25, which ranks individual weaknesses, puts XSS first.
Is WordPress vulnerable to XSS?
Yes, mostly through plugins and themes. NVD descriptions mention both WordPress and XSS in 1,853 CVEs in 2025 and in 1,922 CVEs from January to 7 November 2026.
What share of attacks is XSS?
Fastly reported that XSS made up 40% of observed attack traffic in Q1 2025, up from 35% a year earlier. This is vendor-only data on observed attack requests, not successful attacks.
Does AI-generated code have XSS?
Often. Veracode found that only 18% of AI-generated code samples passed its XSS test on average in October 2026, up from 15% in July. SQL injection passed 83.7% in the same test.
Is XSS dangerous or low impact?
OWASP calls it high frequency and low impact on average, but individual flaws vary. CISA lists 33 exploited XSS flaws, 5 with known ransomware use, and Microsoft rated 2 of 265 XSS cases Critical.
How do you prevent XSS?
Encode output for the context where the data lands, use a framework’s built-in escaping, avoid raw HTML sinks, and add a Content Security Policy as a second layer. Keep plugins, themes and webmail software patched.
What percentage of breaches involve XSS?
There is no reliable current figure. Verizon’s 2026 DBIR does not mention cross-site scripting, and no neutral source reports XSS as a breach share.
