#xss

Live, measured metrics for the hashtag #xss from the open social web. Every number carries a named source and the time it was fetched. Nothing is estimated.

hashtag.org network · sponsored

Own #xss

This #name is available to claim. It becomes your portal on the open agent web: this very page, a keyword you rank for by an open public stake, and a verifiable identity for AI agents. Nobody else sells a page like this for every #name.

$5,313.74/ year · 3-character #name
Claim #xss — $5,313.74/yr→Buy on hashtag.space (web3)
card via hashtag.org · tokens via hashtag.space
4
Uses / 7 days
Mastodon
4
Accounts / 7 days
Mastodon
40
Recent posts
Mastodon
~0/hr
Recent pace
Mastodon · last 40
0
Avg reactions / post
Mastodon · last 40
—
Reddit posts / month
Reddit search
—
Open-web mentions
hashtag.org Firehose

Day-by-day usage

measured · mastodon.online (Mastodon public tags API) · fetched 2026-09-15 11:12 UTC
1
09-09
0
09-10
0
09-11
1
09-12
0
09-13
1
09-14
1
09-15

4 uses by 4 unique accounts across the window. Real per-day counts, not estimates. Newest bar is today so far.

Related hashtags

measured · mastodon.online (Mastodon public search API) · fetched 2026-09-15 11:12 UTC
#StoredXSS
0 uses · 0 accounts / 7d
#xss2shell
0 uses · 0 accounts / 7d
#xssvulnerability
0 uses · 0 accounts / 7d
#xssm
0 uses · 0 accounts / 7d
#FabriXss
0 uses · 0 accounts / 7d
#xssflaw
0 uses · 0 accounts / 7d
#xsser
0 uses · 0 accounts / 7d
#XSSBug
0 uses · 0 accounts / 7d
#BlindXSS
0 uses · 0 accounts / 7d
#dom_xss
0 uses · 0 accounts / 7d
#xss_vulnerability
0 uses · 0 accounts / 7d
#typeii_xss
0 uses · 0 accounts / 7d

Live pulse

measured · mastodon.online (Mastodon tag timeline) · fetched 2026-09-15 11:12 UTC

Everything below is measured over the latest 40 public posts (spanning ~929 hours).

Posting hours (UTC) — busiest: 13:00

00:0012:0023:00

Languages: English (26) · German (6) · Russian (4) · Polish (2) · Portuguese (1) · Italian (1)

Avg boosts / post: 0.6

Top of the latest posts

  • Нужен ли вашему сайту WAF WAF нужен не только крупным порталам и интернет-магазинам, но и любому сайту, доступному из интернета, – вплоть до скромной страницы с услугами или обычной корпоративной визитки. Боты не делят жертв на «достойных а

    Habr@[email protected]♥ 0↻ 02026-09-15 07:12 UTCView post →

  • Strapi 4.x – 4.26.2 & 5.x<5.48.1: CRITICAL stored XSS (CVE-2026-90561, CVSS 8.7) in WYSIWYG preview lets Author roles execute malicious scripts in higher-privileged sessions. Restrict roles & monitor vendor updates. https://radar.offseq.com

    OffSequence@[email protected]♥ 0↻ 12026-09-14 04:30 UTCView post →

  • CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: https://www.valtersit.com/cve/CVE

    Hugo | DevOps | Cybersecurity@[email protected]♥ 0↻ 02026-09-12 07:10 UTCView post →

What “xss” means

Wikipedia

Cross-site scripting (XSS) is a type of security vulnerability that can be found in some web applications. XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. XSS effects vary in range from petty nuisance to significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any securi

“Cross-site scripting” on Wikipedia (CC BY-SA) →

#xss across platforms

every network with a public tag surface

Follow #xss straight to each platform’s own tag page. Where a platform publishes open data we measure it above; the rest lock their numbers behind paid APIs, so we link rather than guess.

X (Twitter) ↗Instagram ↗TikTok ↗Facebook ↗LinkedIn ↗YouTube ↗Threads ↗Bluesky ↗Mastodon ↗Reddit ↗Pinterest ↗Tumblr ↗

Every number above is measured from a named public API at the shown fetch time. Nothing is estimated or extrapolated. Platforms that lock their data behind paid APIs are not shown. Agents: the same numbers, as JSON, at /api/hashtags/xss