> XSS Ranked #1 Top Threat of 2025 by MITRE and CISA

Look who's back! After we completed 2024, XSS managed to get itself ranked as the #1 top threat of the year. I wrote about that, and at the end of the blog post I said "Let's make sure that XSS isn't #1 in 2025!"... Well, I have some bad news...Looking at the dataI wrote a whole bunch in that previous blog post about what the CVE program is and what CWE means, so if you want the background, you should definitely head there and read that post first. Here, I want to take a look at the data and see how things are going. Looking at the list of the Top 25 threat in 2025, and then downloading all of the raw data, we can produce some details on the top threats. CWE ID Vulnerabilities Caused CWE-79 7,303 CWE-89 3,758 CWE-862 2,190 CWE-352 1,682 CWE-22 967 CWE-121 827 CWE-284 796 CWE-78 748 CWE-434 744 CWE-120 732 CWE-200 703 CWE-125 653 CWE-416 642 CWE-502 619 CWE-77 550 CWE-20 516 CWE-122 513 CWE-787 500 CWE-918 483 CWE-476 478 CWE-94 468 CWE-863 409 CWE-639 362 CWE-306 356 CWE-770 317 Total 43,473 Sadly, as we can see, we still have quite a lot of work to do on this front as XSS (CWE-79) continues to absolutely dominate the rankings! Not only was it the top threat, nothing else even came close.Looking further backGiven that the entire archive of the Top 25 is available, I thought I'd take a look at how XSS performed over all the years we have data, back as far as 2010(!), and it's not filling me with confidence. Year XSS Rank 2026 #1 (so far!) 2025 #1 2024 #1 2023 #2 2022 #2 2021 #2 2020 #1 2019 #2 2011 #4 2010 #1 As far back as the data goes, we have seen that XSS is consistently a top ranked threat, never having the left the Top 4!Detecting and Mitigating XSSRegular readers will know by now that Content Security Policy provides for an effective mechanism to protect against XSS. Our sole purpose at Report URI is to help organisations deploy a strong CSP to their website and to monitor for signs of trouble should they arise. We have a whole heap of resources to get you started, so head on over to start a free trial and reach out if you need any support getting going.I have my fingers crossed that we might be able to do something to stop XSS becoming the #1 Top Threat of 2026, but given it already has twice the number of vulnerabilities than its closest competitor, we'd best get started on making some progress soon!