# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing](https://agentprime.io/advisories/CVE-2026-2390.md) `CVE-2026-2390` · CVE record: codesupplyco Powerkit – Supercharge your WordPress Site · CVSS 6.4 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS) - [SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86294.md) `CVE-2026-86294` · CVE record: SourceCodester Simple Traffic Offense System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86278.md) `CVE-2026-86278` · CVE record: SourceCodester Syllabus-Aligned Learning Management & Examination System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [sfturing ssm_pro Order Endpoint OrderController.java cross site scripting](https://agentprime.io/advisories/CVE-2026-86264.md) `CVE-2026-86264` · CVE record: sfturing ssm_pro · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [FastAdmin User Controller User.php login cross site scripting](https://agentprime.io/advisories/CVE-2026-86244.md) `CVE-2026-86244` · CVE record: FastAdmin · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [projectworlds Online Examination System Feedback Form feedback.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86238.md) `CVE-2026-86238` · CVE record: projectworlds Online Examination System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Projectwolds Online Attendance System profile.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86226.md) `CVE-2026-86226` · CVE record: Projectwolds Online Attendance System · CVSS 5.1 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86216.md) `CVE-2026-86216` · CVE record: code-projects Hotel and Tourism Reservation in PHP · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86181.md) `CVE-2026-86181` · CVE record: code-projects Task Management System · CVSS 5.1 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding](https://agentprime.io/advisories/CVE-2026-84219.md) `CVE-2026-84219` · CVE record: Unknown Kirki · CVSS 7.5 High · Not analysed yet · Published 6 Sept 2026 · Tags: Cross-site scripting (XSS) - [Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings](https://agentprime.io/advisories/CVE-2026-84028.md) `CVE-2026-84028` · CVE record: Unknown Bold Page Builder · CVSS 6.8 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Cross-site scripting (XSS) - [AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-86188.md) `CVE-2026-86188` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-76573.md) `CVE-2026-76573` · CVE record: sc0ttkclark Pods – Custom Content Types and Fields · CVSS 6.4 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header](https://agentprime.io/advisories/CVE-2026-83625.md) `CVE-2026-83625` · CVE record: supsysticcom Contact Form by Supsystic · CVSS 7.2 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-85414.md) `CVE-2026-85414` · CVE record: fooplugins Gallery : FooGallery · CVSS 6.4 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData\[id\]' Parameter](https://agentprime.io/advisories/CVE-2026-75586.md) `CVE-2026-75586` · CVE record: unitecms Unlimited Elements For Elementor · CVSS 6.1 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter](https://agentprime.io/advisories/CVE-2026-3853.md) `CVE-2026-3853` · CVE record: Elegant Themes Divi · CVSS 6.4 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters](https://agentprime.io/advisories/CVE-2026-15984.md) `CVE-2026-15984` · CVE record: Themovation QuickCal · CVSS 7.2 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload](https://agentprime.io/advisories/CVE-2026-18406.md) `CVE-2026-18406` · CVE record: brainstormforce SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz · CVSS 7.2 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator](https://agentprime.io/advisories/CVE-2026-78438.md) `CVE-2026-78438` · CVE record: boldgrid W3 Total Cache · CVSS 7.2 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key](https://agentprime.io/advisories/CVE-2026-19769.md) `CVE-2026-19769` · CVE record: kstover Ninja Forms – The Contact Form Builder That Grows With You · CVSS 7.2 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value](https://agentprime.io/advisories/CVE-2026-16649.md) `CVE-2026-16649` · CVE record: Gravity Forms Gravity Forms · CVSS 7.2 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder](https://agentprime.io/advisories/CVE-2026-77830.md) `CVE-2026-77830` · CVE record: cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk · CVSS 7.2 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter](https://agentprime.io/advisories/CVE-2026-18843.md) `CVE-2026-18843` · CVE record: The Beaver Builder Team Beaver Builder Plugin (Starter Version) · CVSS 6.1 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings](https://agentprime.io/advisories/CVE-2026-84935.md) `CVE-2026-84935` · CVE record: Unknown HT Menu · CVSS 8.0 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override](https://agentprime.io/advisories/CVE-2026-84934.md) `CVE-2026-84934` · CVE record: Unknown JCH Optimize · CVSS 8.0 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute](https://agentprime.io/advisories/CVE-2026-84931.md) `CVE-2026-84931` · CVE record: Unknown Joli Table Of Contents · CVSS 6.8 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block Attribute](https://agentprime.io/advisories/CVE-2026-84930.md) `CVE-2026-84930` · CVE record: Unknown CatFolders Document Gallery & PDF Library · CVSS 6.8 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix](https://agentprime.io/advisories/CVE-2026-84899.md) `CVE-2026-84899` · CVE record: Unknown VikWidgetsLoader · CVSS 6.8 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget](https://agentprime.io/advisories/CVE-2026-84896.md) `CVE-2026-84896` · CVE record: Unknown King Addons for Elementor · CVSS 6.8 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes](https://agentprime.io/advisories/CVE-2026-84022.md) `CVE-2026-84022` · CVE record: Unknown Bold Page Builder · CVSS 6.8 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL](https://agentprime.io/advisories/CVE-2026-84021.md) `CVE-2026-84021` · CVE record: Unknown Bold Page Builder · CVSS 6.8 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute](https://agentprime.io/advisories/CVE-2026-83544.md) `CVE-2026-83544` · CVE record: Unknown Greenshift · CVSS 6.8 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields](https://agentprime.io/advisories/CVE-2026-82846.md) `CVE-2026-82846` · CVE record: Unknown Masteriyo LMS · CVSS 6.8 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [IPGP Visitors Origin < 1.6 - Reflected XSS](https://agentprime.io/advisories/CVE-2026-81404.md) `CVE-2026-81404` · CVE record: Unknown IPGP Visitors Origin · CVSS 7.1 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails](https://agentprime.io/advisories/CVE-2026-19861.md) `CVE-2026-19861` · CVE record: Unknown JetFormBuilder — Dynamic Blocks Form Builder · CVSS 4.7 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS](https://agentprime.io/advisories/CVE-2025-15694.md) `CVE-2025-15694` · CVE record: Unknown Joli Table Of Contents · CVSS 3.5 Low · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content](https://agentprime.io/advisories/CVE-2026-77263.md) `CVE-2026-77263` · CVE record: iubenda iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more · CVSS 7.2 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box](https://agentprime.io/advisories/CVE-2026-18404.md) `CVE-2026-18404` · CVE record: quadlayers Social Chat – Click To Chat App Button · CVSS 6.4 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite](https://agentprime.io/advisories/CVE-2026-77233.md) `CVE-2026-77233` · CVE record: iubenda iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more · CVSS 7.2 High · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes](https://agentprime.io/advisories/CVE-2025-14945.md) `CVE-2025-14945` · CVE record: netweblogic Events Manager – Calendar, Bookings, Tickets, and more! · CVSS 5.4 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML](https://agentprime.io/advisories/CVE-2026-8625.md) `CVE-2026-8625` · CVE record: dearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer · CVSS 6.4 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute](https://agentprime.io/advisories/CVE-2026-8623.md) `CVE-2026-8623` · CVE record: dearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer · CVSS 6.4 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Cross-site scripting (XSS) - [Emlog: Stored XSS via Tag Name in Article Editor](https://agentprime.io/advisories/CVE-2026-73848.md) `CVE-2026-73848` · CVE record: emlog emlog · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized](https://agentprime.io/advisories/CVE-2026-53758.md) `CVE-2026-53758` · CVE record: emlog emlog · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Possible XSS in the SNS web administration panel](https://agentprime.io/advisories/CVE-2026-14466.md) `CVE-2026-14466` · CVE record: Stormshield Stormshield Network Security · CVSS 4.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust](https://agentprime.io/advisories/CVE-2026-8447.md) `CVE-2026-8447` · CVE record: IBM Langflow OSS · CVSS 6.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System](https://agentprime.io/advisories/CVE-2026-19727.md) `CVE-2026-19727` · CVE record: Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program · CVSS 6.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS in Gastromenum's Gastromenum Ticket and QR Menu System](https://agentprime.io/advisories/CVE-2026-19057.md) `CVE-2026-19057` · CVE record: Gastromenum Gastromenum Ticket and QR Menu System · CVSS 5.4 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System](https://agentprime.io/advisories/CVE-2026-77818.md) `CVE-2026-77818` · CVE record: Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program · CVSS 6.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS in Menulux Software's Menulux Portal](https://agentprime.io/advisories/CVE-2026-18957.md) `CVE-2026-18957` · CVE record: Menulux Software Inc. Menulux Portal · CVSS 5.4 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy](https://agentprime.io/advisories/CVE-2026-85613.md) `CVE-2026-85613` · CVE record: Openpanel-dev openpanel · CVSS 8.4 High · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Grav Admin before 2.0.20 Cross-Site Scripting via marked.js](https://agentprime.io/advisories/CVE-2026-85601.md) `CVE-2026-85601` · CVE record: getgrav grav · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Grav Admin before 2.0.21 Stored XSS via username](https://agentprime.io/advisories/CVE-2026-85600.md) `CVE-2026-85600` · CVE record: getgrav grav-plugin-admin2 · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters](https://agentprime.io/advisories/CVE-2026-85599.md) `CVE-2026-85599` · CVE record: getgrav grav-plugin-shortcode-core · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages](https://agentprime.io/advisories/CVE-2026-85598.md) `CVE-2026-85598` · CVE record: getgrav grav · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode](https://agentprime.io/advisories/CVE-2026-85593.md) `CVE-2026-85593` · CVE record: thorsten phpMyFAQ · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [AVideo userLogin.php Reflected XSS via error parameter](https://agentprime.io/advisories/CVE-2026-85577.md) `CVE-2026-85577` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [Interinfo｜DreamMaker - Reflected Cross-site Scripting](https://agentprime.io/advisories/CVE-2026-85541.md) `CVE-2026-85541` · CVE record: Interinfo DreamMaker · CVSS 4.8 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-27086.md) `CVE-2026-27086` · CVE record: Xtemos WoodMart · CVSS 6.5 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .