# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-28166.md) `CVE-2026-28166` · CVE record: GoodLayers Tourmaster · CVSS 7.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-28162.md) `CVE-2026-28162` · CVE record: Franky Events Made Easy · CVSS 7.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-78290.md) `CVE-2026-78290` · CVE record: ThemeGrill Magazine Blocks · CVSS 6.5 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66623.md) `CVE-2026-66623` · CVE record: Inisev Social Media & Share Icons · CVSS 7.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66599.md) `CVE-2026-66599` · CVE record: Liquid Web / StellarWP WPComplete · CVSS 7.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66584.md) `CVE-2026-66584` · CVE record: Code for Recovery 12 Step Meeting List · CVSS 7.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS) - [Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values](https://agentprime.io/advisories/CVE-2026-10618.md) `CVE-2026-10618` · CVE record: gohugoio hugo · CVSS 4.8 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5](https://agentprime.io/advisories/CVE-2026-77993.md) `CVE-2026-77993` · CVE record: joomlack.fr Page Builder CK extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS) - [Piwigo Public Authentication cross site scripting](https://agentprime.io/advisories/CVE-2026-78187.md) `CVE-2026-78187` · CVE record: Piwigo · CVSS 2.3 Low · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [Hepta Platforms｜Heptabase - Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-78213.md) `CVE-2026-78213` · CVE record: Hepta Platforms Heptabase · CVSS 6.2 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS) - [A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web script or HTML via the Enter email parame…](https://agentprime.io/advisories/CVE-2022-30983.md) `CVE-2022-30983` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Cross-site scripting (XSS) - [justhtml before 3.11.0 XSS via selectedcontent projection](https://agentprime.io/advisories/CVE-2026-74793.md) `CVE-2026-74793` · CVE record: EmilStenstrom justhtml · CVSS 5.1 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Cross-site scripting (XSS) - [Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters](https://agentprime.io/advisories/CVE-2026-77115.md) `CVE-2026-77115` · CVE record: Unknown Brave · CVSS 7.1 High · Not analysed yet · Published 23 Aug 2026 · Tags: Cross-site scripting (XSS) - [SourceCodester Stock Management System getOrderReport.php cross site scripting](https://agentprime.io/advisories/CVE-2026-78060.md) `CVE-2026-78060` · CVE record: SourceCodester Stock Management System · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Stock Management System printOrder.php cross site scripting](https://agentprime.io/advisories/CVE-2026-78059.md) `CVE-2026-78059` · CVE record: SourceCodester Stock Management System · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting](https://agentprime.io/advisories/CVE-2026-78055.md) `CVE-2026-78055` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting](https://agentprime.io/advisories/CVE-2026-78054.md) `CVE-2026-78054` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2](https://agentprime.io/advisories/CVE-2026-77027.md) `CVE-2026-77027` · CVE record: fabrikar.com Fabrik extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 22 Aug 2026 · Tags: Cross-site scripting (XSS) - [Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-4559.md) `CVE-2026-4559` · CVE record: wpchill Image Photo Gallery Final Tiles Grid · CVSS 6.4 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Cross-site scripting (XSS) - [MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages](https://agentprime.io/advisories/CVE-2026-4561.md) `CVE-2026-4561` · CVE record: dvankooten MC4WP: Mailchimp for WordPress · CVSS 6.4 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0](https://agentprime.io/advisories/CVE-2026-66917.md) `CVE-2026-66917` · CVE record: joomgalleryfriends.net JoomGallery extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 22 Aug 2026 · Tags: Cross-site scripting (XSS) - [Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers](https://agentprime.io/advisories/CVE-2026-76789.md) `CVE-2026-76789` · CVE record: Unknown Slider Hero with Video Background, Animation · CVSS 8.8 High · Not analysed yet · Published 22 Aug 2026 · Tags: Cross-site scripting (XSS) - [Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field](https://agentprime.io/advisories/CVE-2026-16260.md) `CVE-2026-16260` · CVE record: Unknown Post Grid, Slider & Carousel Ultimate · CVSS 6.8 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Cross-site scripting (XSS) - [LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)](https://agentprime.io/advisories/CVE-2026-53529.md) `CVE-2026-53529` · CVE record: perber leafwiki · CVSS 4.8 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in foreign key search criteria](https://agentprime.io/advisories/CVE-2026-33240.md) `CVE-2026-33240` · CVE record: Combodo iTop · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Typemill has Stored HTML Attribute Injection in Metadata Fields](https://agentprime.io/advisories/CVE-2026-53468.md) `CVE-2026-53468` · CVE record: typemill typemill · CVSS 4.6 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in universal search](https://agentprime.io/advisories/CVE-2026-31880.md) `CVE-2026-31880` · CVE record: Combodo iTop · CVSS 8.0 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [YOURLS has stored XSS in referrer statistics chart via crafted Referer header](https://agentprime.io/advisories/GHSA-5h77-88j3-r659.md) `GHSA-5h77-88j3-r659`, `CVE-2026-63135`, `PKSA-v9p2-y9c7-y991` · Packagist `yourls/yourls`: affected `>=1.5.1, <1.10.4`, fixed in `1.10.4` · CVSS 8.2 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors](https://agentprime.io/advisories/GHSA-jg4p-g6xj-4qmf.md) `GHSA-jg4p-g6xj-4qmf`, `CVE-2026-61824` · npm `defuddle`: affected `<0.19.1`, fixed in `0.19.1` · CVSS 8.2 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69233.md) `CVE-2026-69233` · CVE record: Esri Portal for ArcGIS · CVSS 5.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [reflected cross site scripting vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69234.md) `CVE-2026-69234` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69235.md) `CVE-2026-69235` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69236.md) `CVE-2026-69236` · CVE record: Esri Portal for ArcGIS · CVSS 6.1 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [HTML injection vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69237.md) `CVE-2026-69237` · CVE record: Esri Portal for ArcGIS · CVSS 3.8 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in tag admin](https://agentprime.io/advisories/CVE-2026-31803.md) `CVE-2026-31803` · CVE record: Combodo iTop · CVSS 8.0 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69232.md) `CVE-2026-69232` · CVE record: Esri Portal for ArcGIS · CVSS 5.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69231.md) `CVE-2026-69231` · CVE record: Esri Portal for ArcGIS · CVSS 5.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [stored cross site scripting issue in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69230.md) `CVE-2026-69230` · CVE record: Esri Portal for ArcGIS · CVSS 5.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [HTML injection vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69229.md) `CVE-2026-69229` · CVE record: Esri Portal for ArcGIS · CVSS 5.4 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [HTML injection vulnerability in Esri Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-69238.md) `CVE-2026-69238` · CVE record: Esri Portal for ArcGIS · CVSS 3.5 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in synchro/synchro_import.php](https://agentprime.io/advisories/CVE-2026-30890.md) `CVE-2026-30890` · CVE record: Combodo iTop · CVSS 8.0 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in dashboard save](https://agentprime.io/advisories/CVE-2026-30865.md) `CVE-2026-30865` · CVE record: Combodo iTop · CVSS 7.1 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in run_query.php](https://agentprime.io/advisories/CVE-2026-30826.md) `CVE-2026-30826` · CVE record: Combodo iTop · CVSS 8.0 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards](https://agentprime.io/advisories/CVE-2026-77811.md) `CVE-2026-77811` · CVE record: AWS Amazon OpenSearch Service and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter](https://agentprime.io/advisories/CVE-2026-30819.md) `CVE-2026-30819` · CVE record: Combodo iTop · CVSS 7.3 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5](https://agentprime.io/advisories/CVE-2026-74252.md) `CVE-2026-74252` · CVE record: j2commerce.com J2Store extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin](https://agentprime.io/advisories/GHSA-8hgv-xc77-jmcr.md) `GHSA-8hgv-xc77-jmcr`, `CVE-2026-86197`, `PKSA-rjzr-vkvg-cvmf` · Packagist `getgrav/grav`: affected `<2.0.20`, fixed in `2.0.20` · CVSS 5.1 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export](https://agentprime.io/advisories/CVE-2026-54681.md) `CVE-2026-54681` · CVE record: Tyrrrz DiscordChatExporter · CVSS 4.1 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [DiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabled](https://agentprime.io/advisories/CVE-2026-54682.md) `CVE-2026-54682` · CVE record: Tyrrrz DiscordChatExporter · CVSS 8.2 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Element Web: A malicious homeserver can inject HTML in Element Web using its homepage](https://agentprime.io/advisories/CVE-2026-55850.md) `CVE-2026-55850` · CVE record: element-hq element-web · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Jet Admin Stored XSS](https://agentprime.io/advisories/CVE-2026-75933.md) `CVE-2026-75933` · CVE record: Jet Admin Jet Admin · CVSS 8.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66](https://agentprime.io/advisories/CVE-2026-76612.md) `CVE-2026-76612` · CVE record: yootheme.com Zoo extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66](https://agentprime.io/advisories/CVE-2026-77028.md) `CVE-2026-77028` · CVE record: yootheme.com Zoo extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS), Open redirect - [Cross-site scripting in Japan Science and Technology Agency (JST) Miraikan Assist App Android version and others](https://agentprime.io/advisories/CVE-2026-73537.md) `CVE-2026-73537` · CVE record: Japan Science and Technology Agency (JST) Miraikan Assist App Android version and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting](https://agentprime.io/advisories/CVE-2026-14325.md) `CVE-2026-14325` · CVE record: Unknown Drag and Drop Multiple File Upload for Contact Form 7 · CVSS 3.5 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values](https://agentprime.io/advisories/CVE-2026-18409.md) `CVE-2026-18409` · CVE record: WPForms WPForms Pro · CVSS 7.2 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Rocket.Chat](https://agentprime.io/advisories/CVE-2026-65644.md) `CVE-2026-65644` · CVE record: Rocket.Chat Rocket.Chat · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS) - [TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner](https://agentprime.io/advisories/CVE-2026-54505.md) `CVE-2026-54505` · CVE record: mauriceboe TREK · CVSS 2.0 Low · Not analysed yet · Published 20 Aug 2026 · Tags: Cross-site scripting (XSS) - [LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API](https://agentprime.io/advisories/CVE-2026-49436.md) `CVE-2026-49436` · CVE record: Kovah LinkAce · CVSS 7.3 High · Not analysed yet · Published 20 Aug 2026 · Tags: Cross-site scripting (XSS) - [BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name](https://agentprime.io/advisories/CVE-2026-55491.md) `CVE-2026-55491` · CVE record: bigbluebutton bigbluebutton · CVSS 5.4 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .