Skip to content
This repository contains all the XSS cheatsheet data to allow contributions from the community.
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.

This is the data that powers the PortSwigger XSS cheat sheet. We have put this data on Github so the community can contribute vectors via pull requests.


To contribute please create a pull request with changes to the JSON data.

For example, to add onwaiting to the data, do:

"onwaiting": {
        "description": "Fires when while waiting for the data",
        "tags": [
                "tag": "video",
                "code": "<video autoplay controls onwaiting=alert(1)><source src=\"validvideo.mp4\" type=video\/mp4><\/video>",
                "browsers": [
                "interaction": false

The tags array contains the tags supported by the vector and browser support. Supported browsers are chrome,safari,firefox,edge all in lowercase. The interaction flag specifies if the vector requires user interaction.

Please make sure you search the data to ensure your vector hasn't already been added. Please include your Twitter handle in the pull request message if you would like to be credited with it.


The copyright for this project belongs to PortSwigger Web Security. We do not want this data to be used to create derivative cheat sheets hosted elsewhere, so we are not providing a license. That said, you are free to fork this repo in order to create pull requests back.

You can’t perform that action at this time.