# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75711.md)
  `CVE-2026-75711` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2025-64868.md)
  `CVE-2025-64868` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75737.md)
  `CVE-2026-75737` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75681.md)
  `CVE-2026-75681` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-71356.md)
  `CVE-2026-71356` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75696.md)
  `CVE-2026-75696` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75701.md)
  `CVE-2026-75701` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75724.md)
  `CVE-2026-75724` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2025-64542.md)
  `CVE-2025-64542` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75692.md)
  `CVE-2026-75692` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75714.md)
  `CVE-2026-75714` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75657.md)
  `CVE-2026-75657` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2025-64588.md)
  `CVE-2025-64588` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75736.md)
  `CVE-2026-75736` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75693.md)
  `CVE-2026-75693` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75670.md)
  `CVE-2026-75670` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75717.md)
  `CVE-2026-75717` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-79905.md)
  `CVE-2026-79905` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75720.md)
  `CVE-2026-75720` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards](https://agentprime.io/advisories/CVE-2026-84942.md)
  `CVE-2026-84942` · CVE record: AWS Amazon OpenSearch Service and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-76002.md)
  `CVE-2026-76002` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75993.md)
  `CVE-2026-75993` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Skype for Business Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-69642.md)
  `CVE-2026-69642` · CVE record: Microsoft Skype for Business Server 2015 CU13 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Skype for Business Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-63523.md)
  `CVE-2026-63523` · CVE record: Microsoft Skype for Business Server 2015 CU13 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Prowler: Stored XSS in HTML reports through unescaped cloud resource tags](https://agentprime.io/advisories/GHSA-c2jg-2778-ggm4.md)
  `GHSA-c2jg-2778-ggm4`, `CVE-2026-73262`, `PYSEC-2026-3907`, `PYSEC-2026-3908` · PyPI `prowler` and 1 more: affected `<5.37.0`, fixed in `5.37.0` · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-76200.md)
  `CVE-2026-76200` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-76201.md)
  `CVE-2026-76201` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SWC HTML minifier may allow script element breakout when minifying embedded JSON](https://agentprime.io/advisories/GHSA-5qr2-v392-m9g8.md)
  `GHSA-5qr2-v392-m9g8`, `CVE-2026-72925` · crates.io `swc_html_minifier` and 1 more: affected `<59.0.0`, fixed in `59.0.0` · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [AVEVA Pipeline Integrity Monitor cross-site scripting](https://agentprime.io/advisories/CVE-2026-81824.md)
  `CVE-2026-81824` · CVE record: AVEVA Pipeline Integrity Monitor · CVSS 6.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Microsoft Office SharePoint Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-69615.md)
  `CVE-2026-69615` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 3.5 Low · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Microsoft Office SharePoint Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-69417.md)
  `CVE-2026-69417` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 7.3 High · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Microsoft Office SharePoint Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-69402.md)
  `CVE-2026-69402` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 7.3 High · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Microsoft Office SharePoint Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-69690.md)
  `CVE-2026-69690` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 4.6 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Microsoft Exchange Server Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-69356.md)
  `CVE-2026-69356` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [aircheng-org iWebShop-5 pic.php uploadFile cross site scripting](https://agentprime.io/advisories/CVE-2026-86668.md)
  `CVE-2026-86668` · CVE record: aircheng-org iWebShop-5 · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Snipe-IT before 8.7.0 CSS Injection via Custom CSS](https://agentprime.io/advisories/CVE-2026-86738.md)
  `CVE-2026-86738` · CVE record: grokability snipe-it · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [star7th showdoc API Page Save Endpoint editormd.js cross site scripting](https://agentprime.io/advisories/CVE-2026-86644.md)
  `CVE-2026-86644` · CVE record: star7th showdoc · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [XenForo < 2.3.13 XSS via Dynamic Redirect Handler](https://agentprime.io/advisories/CVE-2026-73319.md)
  `CVE-2026-73319` · CVE record: XenForo XenForo · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'](https://agentprime.io/advisories/CVE-2026-12230.md)
  `CVE-2026-12230` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter](https://agentprime.io/advisories/CVE-2026-76931.md)
  `CVE-2026-76931` · CVE record: dylanjkotze Zephyr Project Manager · CVSS 6.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SiYuan before 3.8.2 Remote Code Execution via Clipboard](https://agentprime.io/advisories/CVE-2026-86712.md)
  `CVE-2026-86712` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [UXSS vulnerability in ZTE browser products](https://agentprime.io/advisories/CVE-2026-86550.md)
  `CVE-2026-86550` · CVE record: ZTE NebulaOS · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Siemens Teamcenter V2412 and others](https://agentprime.io/advisories/CVE-2026-58113.md)
  `CVE-2026-58113` · CVE record: Siemens Teamcenter V2412 and 3 more · CVSS 8.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81798.md)
  `CVE-2026-81798` · CVE record: Easy Appointments Easy Appointments · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84818.md)
  `CVE-2026-84818` · CVE record: 100plugins Open User Map · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84817.md)
  `CVE-2026-84817` · CVE record: Crocoblock JetFormBuilder · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84820.md)
  `CVE-2026-84820` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context…](https://agentprime.io/advisories/CVE-2026-78997.md)
  `CVE-2026-78997` · CVE record · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's brow…](https://agentprime.io/advisories/CVE-2026-78838.md)
  `CVE-2026-78838` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction.](https://agentprime.io/advisories/CVE-2026-78742.md)
  `CVE-2026-78742` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiwyg-CKEditor image upload feature.](https://agentprime.io/advisories/CVE-2026-78741.md)
  `CVE-2026-78741` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Document management file upload feature.](https://agentprime.io/advisories/CVE-2026-78738.md)
  `CVE-2026-78738` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a cra…](https://agentprime.io/advisories/CVE-2026-52307.md)
  `CVE-2026-52307` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86491.md)
  `CVE-2026-86491` · CVE record: JetBrains YouTrack · CVSS 3.5 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86484.md)
  `CVE-2026-86484` · CVE record: JetBrains YouTrack · CVSS 4.6 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86483.md)
  `CVE-2026-86483` · CVE record: JetBrains YouTrack · CVSS 5.4 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs](https://agentprime.io/advisories/CVE-2026-86440.md)
  `CVE-2026-86440` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20
- [User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field](https://agentprime.io/advisories/CVE-2026-6431.md)
  `CVE-2026-6431` · CVE record: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 7.2 High · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS)
- [XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import](https://agentprime.io/advisories/CVE-2026-78325.md)
  `CVE-2026-78325` · CVE record: Standard Notes Standard Notes · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS)
- [code-projects Hospital Information System Patient Management editPatient.php cross site scripting](https://agentprime.io/advisories/CVE-2026-86301.md)
  `CVE-2026-86301` · CVE record: code-projects Hospital Information System · CVSS 5.1 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTA5LTA3VDExOjQ1OjA2LjY2MTAwMFoiLCJDVkUtMjAyNi04NjMwMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTA5LTA4VDE5OjU2OjA1LjczNDAwMFoiLCJDVkUtMjAyNi03MTQ0MCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTA5LTA4VDE5OjU2OjA1LjczNDAwMFoiLCJDVkUtMjAyNi03MTQ0MCJd>. Everything for agents: <https://agentprime.io/llms.txt>.