# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Apache Allura: Stored XSS via code repositories](https://agentprime.io/advisories/CVE-2026-80190.md) `CVE-2026-80190` · CVE record: Apache Software Foundation Apache Allura · CVSS 6.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)](https://agentprime.io/advisories/CVE-2026-85229.md) `CVE-2026-85229` · CVE record: Apache Software Foundation Apache SkyWalking · CVSS 6.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Allura: Stored XSS via markdown HTML processing](https://agentprime.io/advisories/CVE-2026-80180.md) `CVE-2026-80180` · CVE record: Apache Software Foundation Apache Allura · CVSS 6.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Eleveo Quality Management Conversation Review cross site scripting](https://agentprime.io/advisories/CVE-2026-85406.md) `CVE-2026-85406` · CVE record: Eleveo Quality Management · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Eleveo Call Recording Software roleAddAction.do cross site scripting](https://agentprime.io/advisories/CVE-2026-85405.md) `CVE-2026-85405` · CVE record: Eleveo Call Recording Software · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting](https://agentprime.io/advisories/CVE-2026-85382.md) `CVE-2026-85382` · CVE record: light0011 cms · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier.](https://agentprime.io/advisories/CVE-2026-79419.md) `CVE-2026-79419` · CVE record · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality.](https://agentprime.io/advisories/CVE-2026-79418.md) `CVE-2026-79418` · CVE record · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote attacker to execute arbitrary code via the captive_portal_s…](https://agentprime.io/advisories/CVE-2026-78849.md) `CVE-2026-78849` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote unauthenticated attacker to inject arbitrary JavaScript into…](https://agentprime.io/advisories/CVE-2026-75170.md) `CVE-2026-75170` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary J…](https://agentprime.io/advisories/CVE-2026-38961.md) `CVE-2026-38961` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.](https://agentprime.io/advisories/CVE-2022-35499.md) `CVE-2022-35499` · CVE record · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external documen…](https://agentprime.io/advisories/CVE-2022-35497.md) `CVE-2022-35497` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter.](https://agentprime.io/advisories/CVE-2022-26961.md) `CVE-2022-26961` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-85453.md) `CVE-2026-85453` · CVE record: themoos core-moos · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [ApostropheCMS: Mutation-XSS / allowedTags bypass via literal \`\\` solidus close](https://agentprime.io/advisories/GHSA-jxwj-j7wr-gfrw.md) `GHSA-jxwj-j7wr-gfrw`, `CVE-2026-63670` · npm `sanitize-html`: affected `<2.17.6`, fixed in `2.17.6` · CVSS 6.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [Material for MkDocs: DOM XSS in search suggestions via query parameter](https://agentprime.io/advisories/GHSA-xvg9-69gf-fjrf.md) `GHSA-xvg9-69gf-fjrf`, `CVE-2026-73295`, `PYSEC-2026-3864` · PyPI `mkdocs-material`: affected `>=7.2.0, <9.7.7`, fixed in `9.7.7` · CVSS 5.4 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [itsourcecode Online Medicine Delivery System index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-85207.md) `CVE-2026-85207` · CVE record: itsourcecode Online Medicine Delivery System · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles](https://agentprime.io/advisories/CVE-2026-82024.md) `CVE-2026-82024` · CVE record: ThimPress LearnPress · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-85303.md) `CVE-2026-85303` · CVE record: Magepeople inc. Booking and Rental Manager · CVSS 6.5 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-85302.md) `CVE-2026-85302` · CVE record: WPKoi WordPress Themes WPKoi Templates for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84848.md) `CVE-2026-84848` · CVE record: brightvesseldev Quick Event Manager · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84812.md) `CVE-2026-84812` · CVE record: wordplus BP Better Messages · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84774.md) `CVE-2026-84774` · CVE record: VeronaLabs WP Statistics · CVSS 6.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84773.md) `CVE-2026-84773` · CVE record: 作者: Shane Bishop EWWW Image Optimizer · CVSS 7.2 High · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84765.md) `CVE-2026-84765` · CVE record: John Havlik Breadcrumb NavXT · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84763.md) `CVE-2026-84763` · CVE record: rometheme RTMKit · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81776.md) `CVE-2026-81776` · CVE record: advanpix WP QuickLaTeX · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81773.md) `CVE-2026-81773` · CVE record: Saturday Drive Ninja Forms File Uploads Extension · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81300.md) `CVE-2026-81300` · CVE record: silverplugins217 Calculation For Contact Form 7 · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81295.md) `CVE-2026-81295` · CVE record: UnderConstructionPage Under Construction · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81292.md) `CVE-2026-81292` · CVE record: Ido Kobelkowsky Simple Payment · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81282.md) `CVE-2026-81282` · CVE record: VillaTheme Product Variations Swatches for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81281.md) `CVE-2026-81281` · CVE record: silverks Graphene · CVSS 6.5 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass](https://agentprime.io/advisories/GHSA-99rq-75j6-5j9f.md) `GHSA-99rq-75j6-5j9f`, `CVE-2026-66394`, `GO-2026-6364` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260714095344-f08dee71ba8e`, fixed in `0.0.0-20260714095344-f08dee71ba8e` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection](https://agentprime.io/advisories/CVE-2026-85230.md) `CVE-2026-85230` · CVE record: misp misp · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20 - [Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters](https://agentprime.io/advisories/CVE-2026-85227.md) `CVE-2026-85227` · CVE record: misp misp · CVSS 6.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php](https://agentprime.io/advisories/CVE-2026-56128.md) `CVE-2026-56128` · CVE record: Netgate pfSense Plus and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php](https://agentprime.io/advisories/CVE-2026-56127.md) `CVE-2026-56127` · CVE record: Netgate pfSense Plus and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php](https://agentprime.io/advisories/CVE-2026-56126.md) `CVE-2026-56126` · CVE record: Netgate pfSense Plus and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84815.md) `CVE-2026-84815` · CVE record: Kriesi Enfold · CVSS 5.8 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5](https://agentprime.io/advisories/CVE-2026-78000.md) `CVE-2026-78000` · CVE record: j2commerce.com J2Store extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [AVideo Reflected XSS via cancelUri in userLogin.php](https://agentprime.io/advisories/CVE-2026-85159.md) `CVE-2026-85159` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [AVideo Reflected XSS via videoEmbeded.php link parameter](https://agentprime.io/advisories/CVE-2026-85158.md) `CVE-2026-85158` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [Multiple vulnerabilities in Ocsreports for OCS Inventory NG](https://agentprime.io/advisories/CVE-2026-76178.md) `CVE-2026-76178` · CVE record: OCS Inventory NG Ocsreports · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter](https://agentprime.io/advisories/CVE-2026-3852.md) `CVE-2026-3852` · CVE record: Elegant Themes Divi · CVSS 6.4 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'](https://agentprime.io/advisories/CVE-2026-2573.md) `CVE-2026-2573` · CVE record: ataurr GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor · CVSS 6.4 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS) - [langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting](https://agentprime.io/advisories/CVE-2026-85022.md) `CVE-2026-85022` · CVE record: langgenius dify · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [langgenius dify Splash Layout splash.tsx router.replace cross site scripting](https://agentprime.io/advisories/CVE-2026-85021.md) `CVE-2026-85021` · CVE record: langgenius dify · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)](https://agentprime.io/advisories/GHSA-gcr2-9v8m-gq45.md) `GHSA-gcr2-9v8m-gq45`, `CVE-2026-68921` · npm `@dicebear/core` and 1 more: affected `<9.4.3`, fixed in `9.4.3` · CVSS 4.7 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-184 - [SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload](https://agentprime.io/advisories/CVE-2026-75134.md) `CVE-2026-75134` · CVE record: SEOWriting SEOWriting · CVSS 5.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Jenkins Project Jenkins update-center2](https://agentprime.io/advisories/CVE-2026-84677.md) `CVE-2026-84677` · CVE record: Jenkins Project Jenkins update-center2 · CVSS 5.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Jenkins Project Jenkins Customizable Header Plugin](https://agentprime.io/advisories/CVE-2026-84673.md) `CVE-2026-84673` · CVE record: Jenkins Project Jenkins Customizable Header Plugin · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Jenkins Project Jenkins SonarQube Scanner Plugin](https://agentprime.io/advisories/CVE-2026-84665.md) `CVE-2026-84665` · CVE record: Jenkins Project Jenkins SonarQube Scanner Plugin · CVSS 8.0 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Jenkins](https://agentprime.io/advisories/CVE-2026-84648.md) `CVE-2026-84648` · CVE record: Jenkins Project Jenkins · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Sulu: Stored XSS via media download inline-disposition override](https://agentprime.io/advisories/GHSA-pp4x-ccxq-6r33.md) `GHSA-pp4x-ccxq-6r33`, `CVE-2026-82396`, `PKSA-nbbf-nf63-19vd` · Packagist `sulu/sulu`: affected `<2.6.25 || >=3.0.0-alpha1, <3.0.8`, fixed in `2.6.25`, `3.0.8` · CVSS 5.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Tiptap: mergeAttributes() turns an own \_\_proto\_\_ key into inherited executable DOM attributes](https://agentprime.io/advisories/GHSA-cp6q-959q-f8rh.md) `GHSA-cp6q-959q-f8rh` · npm `@tiptap/core`: affected `>=2.0.0-alpha.0, <3.30.4`, fixed in `3.30.4` · CVSS 4.0, no score published · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS), Prototype pollution - [Livewire DOM-based cross-site scripting during client-side state handling](https://agentprime.io/advisories/GHSA-g3hc-697w-wm82.md) `GHSA-g3hc-697w-wm82`, `CVE-2026-81887`, `PKSA-bgw4-5zmg-2njg` · Packagist `livewire/livewire`: affected `>=3.0.0-beta.1, <3.8.3 || >=4.0.0-beta.1, <4.3.4`, fixed in `3.8.3`, `4.3.4` · CVSS 5.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS), Prototype pollution - [LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode](https://agentprime.io/advisories/CVE-2024-3773.md) `CVE-2024-3773` · CVE record: Unknown LiveJournal Shortcode · CVSS 5.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets](https://agentprime.io/advisories/CVE-2026-83547.md) `CVE-2026-83547` · CVE record: Unknown Xpro Addons · CVSS 6.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .