Score reflected, stored and DOM XSS risk from output encoding, sanitiser quality, CSP strength and the privilege of the likely victim.
Stored XSS scores highest on likelihood because the payload fires without the attacker needing to lure anyone, and DOM XSS sits above reflected because it often bypasses server-side filtering entirely. Impact is driven by who executes the payload: an administrator session with a readable cookie is a full application takeover. XSS severity is decided by the second line of defence, not the injection itself — the same flaw is a Low with a nonce CSP and HttpOnly cookies, and a Critical without them.
Cross-Site Scripting (XSS) Risk
Likelihood = mean(XSS class, output encoding, sanitiser quality, CSP strength); impact = mean(cookie flags, reachable audience, victim privilege) on the OWASP 0–9 scale.
Likelihood = mean(XSS class, output encoding, sanitiser quality, CSP strength); impact = mean(cookie flags, reachable audience, victim privilege) on the OWASP 0–9 scale. Stored XSS scores highest on likelihood because the payload fires without the attacker needing to lure anyone, and DOM XSS sits above reflected because it often bypasses server-side filtering entirely. Impact is driven by who executes the payload: an administrator session with a readable cookie is a full application takeover.
XSS severity is decided by the second line of defence, not the injection itself — the same flaw is a Low with a nonce CSP and HttpOnly cookies, and a Critical without them.
This calculator takes 7 inputs: XSS class, Context-aware output encoding, HTML sanitiser on rich-text input, Content Security Policy, Session cookie flags, Audience the payload can reach, Privilege of the likely victim. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because a strict CSP stops the injected script from running at all, which changes whether the exploit succeeds — that is a likelihood question. Cookie flags, by contrast, limit what a successful payload can steal, so they belong to impact.