# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url](https://agentprime.io/advisories/CVE-2026-18147.md)
  `CVE-2026-18147` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.1 High · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability.](https://agentprime.io/advisories/CVE-2026-79946.md)
  `CVE-2026-79946` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Snipe-IT 8.6.3 Stored XSS via Department Names](https://agentprime.io/advisories/CVE-2026-86772.md)
  `CVE-2026-86772` · CVE record: grokability snipe-it · CVSS 5.1 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SiYuan before v3.8.2 Stored XSS via Asset Preview](https://agentprime.io/advisories/CVE-2026-87814.md)
  `CVE-2026-87814` · CVE record: siyuan-note siyuan · CVSS 8.4 High · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SiYuan before v3.8.2 Stored XSS via unescaped asset filenames](https://agentprime.io/advisories/CVE-2026-87813.md)
  `CVE-2026-87813` · CVE record: siyuan-note siyuan · CVSS 8.4 High · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SiYuan before v3.8.2 Stored XSS via Bazaar iconURL](https://agentprime.io/advisories/CVE-2026-87812.md)
  `CVE-2026-87812` · CVE record: siyuan-note siyuan · CVSS 7.4 High · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SiYuan before v3.8.2 Stored XSS via notebook template paths](https://agentprime.io/advisories/CVE-2026-87811.md)
  `CVE-2026-87811` · CVE record: siyuan-note siyuan · CVSS 8.4 High · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [DOM-based XSS vulnerability in OpenText™ Documentum Webtop](https://agentprime.io/advisories/CVE-2025-3271.md)
  `CVE-2025-3271` · CVE record: OpenText™ Documentum Webtop · CVSS 4.8 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter](https://agentprime.io/advisories/CVE-2026-14989.md)
  `CVE-2026-14989` · CVE record: wplegalpages WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode · CVSS 7.2 High · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-17149.md)
  `CVE-2026-17149` · CVE record: saadiqbal Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred · CVSS 6.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education](https://agentprime.io/advisories/CVE-2025-7062.md)
  `CVE-2025-7062` · CVE record: Lumi Education UG h5p-nodejs-library · CVSS 5.2 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20
- [Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget](https://agentprime.io/advisories/CVE-2026-85418.md)
  `CVE-2026-85418` · CVE record: Unknown Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More · CVSS 5.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget](https://agentprime.io/advisories/CVE-2026-83541.md)
  `CVE-2026-83541` · CVE record: Unknown Sina Extension for Elementor · CVSS 6.8 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles](https://agentprime.io/advisories/CVE-2025-15690.md)
  `CVE-2025-15690` · CVE record: Unknown Content Mask · CVSS 6.8 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter](https://agentprime.io/advisories/CVE-2026-83593.md)
  `CVE-2026-83593` · CVE record: quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services · CVSS 7.2 High · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter](https://agentprime.io/advisories/CVE-2026-19945.md)
  `CVE-2026-19945` · CVE record: themeum WP Crowdfunding · CVSS 6.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor\[..\]\[..\]\[comment\]' Parameter](https://agentprime.io/advisories/CVE-2026-75966.md)
  `CVE-2026-75966` · CVE record: eteubert Podlove Podcast Publisher · CVSS 6.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter](https://agentprime.io/advisories/CVE-2026-19797.md)
  `CVE-2026-19797` · CVE record: gm_alex User Access Manager · CVSS 6.1 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-77187.md)
  `CVE-2026-77187` · CVE record: joedolson My Calendar – Accessible Event Manager · CVSS 6.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-77186.md)
  `CVE-2026-77186` · CVE record: joedolson My Calendar – Accessible Event Manager · CVSS 6.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values](https://agentprime.io/advisories/CVE-2026-84293.md)
  `CVE-2026-84293` · CVE record: addonsorg Repeater Fields for Gravity Forms · CVSS 7.2 High · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter](https://agentprime.io/advisories/CVE-2026-7804.md)
  `CVE-2026-7804` · CVE record: woobewoo Product Filter for WooCommerce by WBW · CVSS 6.1 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting](https://agentprime.io/advisories/CVE-2026-13709.md)
  `CVE-2026-13709` · CVE record: iqonicdesign Graphina – Charts and Graphs For Elementor · CVSS 6.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter](https://agentprime.io/advisories/CVE-2026-13359.md)
  `CVE-2026-13359` · CVE record: bestweblayout Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress · CVSS 7.2 High · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Google Chrome](https://agentprime.io/advisories/CVE-2026-87632.md)
  `CVE-2026-87632` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS).](https://agentprime.io/advisories/CVE-2026-75308.md)
  `CVE-2026-75308` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint.](https://agentprime.io/advisories/CVE-2026-75307.md)
  `CVE-2026-75307` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability.](https://agentprime.io/advisories/CVE-2026-71803.md)
  `CVE-2026-71803` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3.](https://agentprime.io/advisories/CVE-2026-71802.md)
  `CVE-2026-71802` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SVGO: removeScripts allows executable links through namespace and control-character bypasses](https://agentprime.io/advisories/GHSA-w27v-7q3p-w38r.md)
  `GHSA-w27v-7q3p-w38r`, `CVE-2026-84370` · npm `svgo`: affected `>=1.0.0, <2.8.4 || >=3.0.0, <3.3.5 || >=4.0.0, <4.1.0`, fixed in `2.8.4`, `3.3.5`, `4.1.0` · CVSS 8.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-184
- [SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements](https://agentprime.io/advisories/GHSA-4vpr-x523-8j87.md)
  `GHSA-4vpr-x523-8j87`, `CVE-2026-84369` · npm `svgo`: affected `>=1.0.0, <2.8.4 || >=3.0.0, <3.3.5 || >=4.0.0, <4.1.0`, fixed in `2.8.4`, `3.3.5`, `4.1.0` · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip](https://agentprime.io/advisories/GHSA-jrc7-96c5-q579.md)
  `GHSA-jrc7-96c5-q579`, `CVE-2026-85061` · npm `maplibre-gl`: affected `<6.4.1`, fixed in `6.4.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector](https://agentprime.io/advisories/CVE-2026-85982.md)
  `CVE-2026-85982` · CVE record: Auth0 Auth0 AD/LDAP Connector · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method](https://agentprime.io/advisories/CVE-2026-85630.md)
  `CVE-2026-85630` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping](https://agentprime.io/advisories/CVE-2026-85485.md)
  `CVE-2026-85485` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping](https://agentprime.io/advisories/CVE-2026-85484.md)
  `CVE-2026-85484` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message](https://agentprime.io/advisories/CVE-2026-19872.md)
  `CVE-2026-19872` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-71357.md)
  `CVE-2026-71357` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75678.md)
  `CVE-2026-75678` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-71565.md)
  `CVE-2026-71565` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75687.md)
  `CVE-2026-75687` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75672.md)
  `CVE-2026-75672` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75734.md)
  `CVE-2026-75734` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75706.md)
  `CVE-2026-75706` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75730.md)
  `CVE-2026-75730` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75719.md)
  `CVE-2026-75719` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75707.md)
  `CVE-2026-75707` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75690.md)
  `CVE-2026-75690` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75715.md)
  `CVE-2026-75715` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2025-64838.md)
  `CVE-2025-64838` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75646.md)
  `CVE-2026-75646` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75640.md)
  `CVE-2026-75640` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75643.md)
  `CVE-2026-75643` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-19612.md)
  `CVE-2026-19612` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75660.md)
  `CVE-2026-75660` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-19479.md)
  `CVE-2026-19479` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75735.md)
  `CVE-2026-75735` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75637.md)
  `CVE-2026-75637` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75705.md)
  `CVE-2026-75705` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75694.md)
  `CVE-2026-75694` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTA5LTA4VDE5OjU2OjQ5LjIxMjAwMFoiLCJDVkUtMjAyNi03NTY5NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTA5LTA5VDE3OjU2OjIyLjAwMDAwMFoiLCJHSFNBLWc4cmgtZmptNi1oMmg5Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTA5LTA5VDE3OjU2OjIyLjAwMDAwMFoiLCJHSFNBLWc4cmgtZmptNi1oMmg5Il0>. Everything for agents: <https://agentprime.io/llms.txt>.