Cross-Site Scripting (XSS) Risk Calculator
Score reflected, stored and DOM XSS risk from output encoding, sanitiser quality, CSP strength and the privilege of the likely victim.
Inputs
Overall Risk Severity
Critical
Likelihood Score
7.00/ 9
Impact Score
7.33/ 9
Risk Score
5.70/ 9
CSP as a Second Line of Defence
Weak — unsafe-inline defeats the policy
Highest-Value Fix
Encode output for its context: HTML, attribute, JavaScript and URL
Step by step
Values used
XSS class = Stored or persistent — 9; Context-aware output encoding = Ad-hoc HTML escaping only — 6; HTML sanitiser on rich-text input = Home-grown deny-list filter — 7; Content Security Policy = Allow-list with unsafe-inline — 6; Session cookie flags = HttpOnly only — 6; Audience the payload can reach = Anonymous visitors and administrators — 9; Privilege of the likely victim = Privileged operator — 7
Cross-Site Scripting (XSS) Risk
Likelihood = mean(XSS class, output encoding, sanitiser quality, CSP strength); impact = mean(cookie flags, reachable audience, victim privilege) on the OWASP 0–9 scale.
Overall Risk Severity
= Critical
Likelihood Score
= 7.00 / 9
Impact Score
= 7.33 / 9
Risk Score
= 5.70 / 9
CSP as a Second Line of Defence
= Weak — unsafe-inline defeats the policy
Highest-Value Fix
= Encode output for its context: HTML, attribute, JavaScript and URL
How it works
Stored XSS scores highest on likelihood because the payload fires without the attacker needing to lure anyone, and DOM XSS sits above reflected because it often bypasses server-side filtering entirely. Impact is driven by who executes the payload: an administrator session with a readable cookie is a full application takeover. XSS severity is decided by the second line of defence, not the injection itself — the same flaw is a Low with a nonce CSP and HttpOnly cookies, and a Critical without them.
Formula
Cross-Site Scripting (XSS) Risk
Likelihood = mean(XSS class, output encoding, sanitiser quality, CSP strength); impact = mean(cookie flags, reachable audience, victim privilege) on the OWASP 0–9 scale.
- xssType
- 5 reflected, 7 DOM, 9 stored
- csp
- 1 nonce-based … 9 no policy
- privilege
- Privilege the stolen session carries
Frequently Asked Questions
How is Cross-Site Scripting (XSS) Risk calculated?
Likelihood = mean(XSS class, output encoding, sanitiser quality, CSP strength); impact = mean(cookie flags, reachable audience, victim privilege) on the OWASP 0–9 scale. Stored XSS scores highest on likelihood because the payload fires without the attacker needing to lure anyone, and DOM XSS sits above reflected because it often bypasses server-side filtering entirely. Impact is driven by who executes the payload: an administrator session with a readable cookie is a full application takeover.
Why does Cross-Site Scripting (XSS) Risk matter?
XSS severity is decided by the second line of defence, not the injection itself — the same flaw is a Low with a nonce CSP and HttpOnly cookies, and a Critical without them.
What values do I need to enter?
This calculator takes 7 inputs: XSS class, Context-aware output encoding, HTML sanitiser on rich-text input, Content Security Policy, Session cookie flags, Audience the payload can reach, Privilege of the likely victim. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why does CSP appear under likelihood rather than impact?
Because a strict CSP stops the injected script from running at all, which changes whether the exploit succeeds — that is a likelihood question. Cookie flags, by contrast, limit what a successful payload can steal, so they belong to impact.