# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first - [Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses](https://agentprime.io/advisories/CVE-2026-88986.md) `CVE-2026-88986` · CVE record: kubeflow pipelines · CVSS 6.1 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox](https://agentprime.io/advisories/CVE-2026-110802.md) `CVE-2026-110802` · CVE record: altair-graphql altair and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS), CWE-829 - [OpenEMR: Stored XSS via \`text()\` Misuse in Double-Quoted HTML Attribute](https://agentprime.io/advisories/CVE-2026-103935.md) `CVE-2026-103935` · CVE record: openemr openemr · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in OpenText Directory Services (OTDS)](https://agentprime.io/advisories/CVE-2026-76580.md) `CVE-2026-76580` · CVE record: OpenText OpenText Directory Services (OTDS) · CVSS 6.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0](https://agentprime.io/advisories/CVE-2026-107903.md) `CVE-2026-107903` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0](https://agentprime.io/advisories/CVE-2026-105607.md) `CVE-2026-105607` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6](https://agentprime.io/advisories/CVE-2026-115452.md) `CVE-2026-115452` · CVE record: tassos.gr Advanced Custom Fields extension for Joomla and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [HomeBox: Stored XSS via \`javascript:\` URI in Custom Entity Fields](https://agentprime.io/advisories/CVE-2026-75599.md) `CVE-2026-75599` · CVE record: sysadminsmedia homebox · CVSS 5.4 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS](https://agentprime.io/advisories/CVE-2026-102615.md) `CVE-2026-102615` · CVE record: heyform heyform · CVSS 7.6 High · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name](https://agentprime.io/advisories/CVE-2026-123094.md) `CVE-2026-123094` · CVE record: huginn huginn · CVSS 5.1 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [HTML Injection in Fileorbis](https://agentprime.io/advisories/CVE-2026-76563.md) `CVE-2026-76563` · CVE record: Fileorbis Informatics Services Trade Inc. Fileorbis · CVSS 6.1 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session](https://agentprime.io/advisories/CVE-2026-114229.md) `CVE-2026-114229` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths](https://agentprime.io/advisories/CVE-2026-103863.md) `CVE-2026-103863` · CVE record: Apache Software Foundation Apache Sling Engine · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS), CWE-693 - [Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome](https://agentprime.io/advisories/CVE-2026-96677.md) `CVE-2026-96677` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in SHIRASAGI](https://agentprime.io/advisories/CVE-2026-117679.md) `CVE-2026-117679` · CVE record: SHIRASAGI Project SHIRASAGI · CVSS 5.1 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile](https://agentprime.io/advisories/CVE-2026-120533.md) `CVE-2026-120533` · CVE record: davidanderson Redux Framework · CVSS 6.4 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key](https://agentprime.io/advisories/CVE-2026-104812.md) `CVE-2026-104812` · CVE record: davidanderson Redux Framework · CVSS 6.4 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-120553.md) `CVE-2026-120553` · CVE record: ivole Customer Reviews for WooCommerce · CVSS 6.4 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS) - [SourceCodester Online Food Ordering System Category Management add_category.php cross site scripting](https://agentprime.io/advisories/CVE-2026-122190.md) `CVE-2026-122190` · CVE record: SourceCodester Online Food Ordering System · CVSS 4.8 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection - [VitaFit Cloud API Stored XSS via SVG File Upload](https://agentprime.io/advisories/CVE-2026-54380.md) `CVE-2026-54380` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 5.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters](https://agentprime.io/advisories/CVE-2026-122234.md) `CVE-2026-122234` · CVE record: benjamine jsondiffpatch · CVSS 2.3 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList](https://agentprime.io/advisories/CVE-2025-71453.md) `CVE-2025-71453` · CVE record: vtenext vtenext · CVSS 5.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab](https://agentprime.io/advisories/CVE-2026-113369.md) `CVE-2026-113369` · CVE record: Sonatype Nexus Repository 3 · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Zammad: Stored XSS in ticket article rendering in the new Vue-based interface](https://agentprime.io/advisories/CVE-2026-102345.md) `CVE-2026-102345` · CVE record: zammad zammad · CVSS 5.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [EmpireSoft EmpireCMS index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-121929.md) `CVE-2026-121929` · CVE record: EmpireSoft EmpireCMS · CVSS 5.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection - [InfiniFlow RAGFlow Images API file_utils.py cross site scripting](https://agentprime.io/advisories/CVE-2026-121928.md) `CVE-2026-121928` · CVE record: InfiniFlow RAGFlow · CVSS 5.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection - [DataGerry < 3.3.0 SSTI via DocAPI Template Rendering](https://agentprime.io/advisories/CVE-2026-57853.md) `CVE-2026-57853` · CVE record: DataGerry DataGerry · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection - [Cisco Unified Communications Manager Cross-Site Scripting Vulnerability](https://agentprime.io/advisories/CVE-2026-76419.md) `CVE-2026-76419` · CVE record: Cisco Cisco Unified Communications Manager · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values](https://agentprime.io/advisories/GHSA-3cgg-c5pp-57h6.md) `GHSA-3cgg-c5pp-57h6`, `CVE-2026-113787` · npm `odf-kit`: affected `>=0.6.0, <0.14.2`, fixed in `0.14.2` · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Reflected XSS via client window id in URL client window mode](https://agentprime.io/advisories/CVE-2026-120421.md) `CVE-2026-120421` · CVE record: Eclipse Foundation Eclipse Mojarra · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile](https://agentprime.io/advisories/CVE-2026-121008.md) `CVE-2026-121008` · CVE record · No CVSS score · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output](https://agentprime.io/advisories/CVE-2026-114627.md) `CVE-2026-114627` · CVE record · No CVSS score · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping](https://agentprime.io/advisories/CVE-2026-121632.md) `CVE-2026-121632` · CVE record · No CVSS score · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-119468.md) `CVE-2026-119468` · CVE record: Noptin Newsletter Team Noptin · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Remove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer](https://agentprime.io/advisories/CVE-2026-97397.md) `CVE-2026-97397` · CVE record: easywpstuff Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance · CVSS 7.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Multiple vulnerabilities in Coupa’s Total Spend Management Platform](https://agentprime.io/advisories/CVE-2026-111040.md) `CVE-2026-111040` · CVE record: Coupa Coupa Total Spend Management Platform · CVSS 5.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Multiple vulnerabilities in Coupa’s Total Spend Management Platform](https://agentprime.io/advisories/CVE-2026-111037.md) `CVE-2026-111037` · CVE record: Coupa Coupa Total Spend Management Platform · CVSS 5.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field](https://agentprime.io/advisories/CVE-2026-115498.md) `CVE-2026-115498` · CVE record: wingerspeed Slim Jetpack · CVSS 7.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-93900.md) `CVE-2026-93900` · CVE record: elliotvs Simple CAPTCHA with Cloudflare Turnstile · CVSS 6.4 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-57666.md) `CVE-2026-57666` · CVE record: Aguila Technologies WP Customer Area · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-119366.md) `CVE-2026-119366` · CVE record: AdvancedCoding wpDiscuz · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62007.md) `CVE-2026-62007` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-54861.md) `CVE-2026-54861` · CVE record: Aguila Technologies WP Customer Area · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-57639.md) `CVE-2026-57639` · CVE record: Roland Murg WP Booking System · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-119477.md) `CVE-2026-119477` · CVE record: Jacob N. Breetvelt WP Photo Album Plus · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-54851.md) `CVE-2026-54851` · CVE record: Awesomemotive Contact Form by WPForms · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks](https://agentprime.io/advisories/CVE-2026-118983.md) `CVE-2026-118983` · CVE record: Unknown VikWidgetsLoader · CVSS 6.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-118783.md) `CVE-2026-118783` · CVE record: Unknown All-in-One Video Gallery · CVSS 6.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Text Typing < 2.2.2 - Contributor+ Stored XSS](https://agentprime.io/advisories/CVE-2026-115250.md) `CVE-2026-115250` · CVE record: Unknown Text Typing · CVSS 6.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload](https://agentprime.io/advisories/CVE-2026-114431.md) `CVE-2026-114431` · CVE record: Unknown Enable Media Replace · CVSS 6.4 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter](https://agentprime.io/advisories/CVE-2026-112243.md) `CVE-2026-112243` · CVE record: Unknown Duplicator and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings](https://agentprime.io/advisories/CVE-2026-108041.md) `CVE-2026-108041` · CVE record: Unknown SEOPress · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action](https://agentprime.io/advisories/CVE-2026-106649.md) `CVE-2026-106649` · CVE record: Unknown Kali Forms — Contact Form & Drag-and-Drop Builder · CVSS 6.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values](https://agentprime.io/advisories/CVE-2026-105413.md) `CVE-2026-105413` · CVE record: Unknown Form Maker by 10Web · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts](https://agentprime.io/advisories/CVE-2026-104719.md) `CVE-2026-104719` · CVE record: Unknown CookieYes · CVSS 6.4 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS) - [CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment](https://agentprime.io/advisories/CVE-2026-120648.md) `CVE-2026-120648` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS) - [CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url](https://agentprime.io/advisories/CVE-2026-120643.md) `CVE-2026-120643` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS) - [CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form](https://agentprime.io/advisories/CVE-2026-120636.md) `CVE-2026-120636` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS), Open redirect - [HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation](https://agentprime.io/advisories/CVE-2026-115541.md) `CVE-2026-115541` · CVE record: HumHub HumHub Community Edition · CVSS 7.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Dell Wyse Management Suite](https://agentprime.io/advisories/CVE-2026-82160.md) `CVE-2026-82160` · CVE record: Dell Wyse Management Suite · CVSS 3.3 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS) Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .