# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-75965.md) `CVE-2026-75965` · CVE record: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd\[displ\]\[style\]' Parameter](https://agentprime.io/advisories/CVE-2026-19796.md) `CVE-2026-19796` · CVE record: webilia Listdom: AI-powered Business Directory with Classifieds Ads Listings · CVSS 7.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-82229.md) `CVE-2026-82229` · CVE record: miniOrange WordPress Social Login and Register · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-82224.md) `CVE-2026-82224` · CVE record: iova.mihai SliceWP · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-82221.md) `CVE-2026-82221` · CVE record: Metagauss RegistrationMagic · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81778.md) `CVE-2026-81778` · CVE record: The4 Kalles Addons · CVSS 6.5 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81768.md) `CVE-2026-81768` · CVE record: highwarden Super Store Finder · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81765.md) `CVE-2026-81765` · CVE record: Tailored Media Tailored Tools · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81764.md) `CVE-2026-81764` · CVE record: Acato Email Essentials · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81298.md) `CVE-2026-81298` · CVE record: varunvairavanlc LeadConnector · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81291.md) `CVE-2026-81291` · CVE record: Uncode Uncode · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81290.md) `CVE-2026-81290` · CVE record: Icegram Email Subscribers & Newsletters · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Typora Mermaid Rendering cross site scripting](https://agentprime.io/advisories/CVE-2026-82805.md) `CVE-2026-82805` · CVE record: Typora · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82700.md) `CVE-2026-82700` · CVE record: code-projects Online Shopping System · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11](https://agentprime.io/advisories/CVE-2026-78077.md) `CVE-2026-78077` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue](https://agentprime.io/advisories/CVE-2026-76986.md) `CVE-2026-76986` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in Palette via getAdditionalAttributes](https://agentprime.io/advisories/CVE-2026-76985.md) `CVE-2026-76985` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel](https://agentprime.io/advisories/CVE-2026-76983.md) `CVE-2026-76983` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute](https://agentprime.io/advisories/CVE-2026-76984.md) `CVE-2026-76984` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in Button via its model object](https://agentprime.io/advisories/CVE-2026-76982.md) `CVE-2026-76982` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel](https://agentprime.io/advisories/CVE-2026-75802.md) `CVE-2026-75802` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown](https://agentprime.io/advisories/CVE-2026-82881.md) `CVE-2026-82881` · CVE record: apconw Aix-DB · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82664.md) `CVE-2026-82664` · CVE record: yaojingang GEOFlow · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [Default webserver configuration with incorrect CSP](https://agentprime.io/advisories/CVE-2026-82838.md) `CVE-2026-82838` · CVE record: pretix venueless · CVSS 6.4 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [code-projects Simple Inventory System User Registration register.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82625.md) `CVE-2026-82625` · CVE record: code-projects Simple Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP](https://agentprime.io/advisories/CVE-2026-40464.md) `CVE-2026-40464` · CVE record: Nokia NSP · CVSS 5.4 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82622.md) `CVE-2026-82622` · CVE record: code-projects Employee Leave Managing System · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [Stored XSS in AshAdmin relationship typeahead via unescaped label_field content](https://agentprime.io/advisories/GHSA-m23x-576h-73w8.md) `GHSA-m23x-576h-73w8`, `CVE-2026-77850`, `EEF-CVE-2026-77850` · Hex `ash_admin`: affected `>=0.13.0, <1.3.1`, fixed in `1.3.1` · CVSS 8.4 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [SeaCMS err.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82601.md) `CVE-2026-82601` · CVE record: SeaCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803.](https://agentprime.io/advisories/CVE-2026-51153.md) `CVE-2026-51153` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [TechStore 1.0 is vulnerable to Cross Site Scripting (XSS).](https://agentprime.io/advisories/CVE-2025-63607.md) `CVE-2025-63607` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [SourceCodester Queue Management System add_customer.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82554.md) `CVE-2026-82554` · CVE record: SourceCodester Queue Management System · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [SiYuan before v3.8.1 Stored XSS via block name](https://agentprime.io/advisories/CVE-2026-82654.md) `CVE-2026-82654` · CVE record: siyuan-note siyuan · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS) - [SiYuan before v3.8.1 Stored XSS via confirmDialog](https://agentprime.io/advisories/CVE-2026-82653.md) `CVE-2026-82653` · CVE record: siyuan-note siyuan · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS) - [WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php](https://agentprime.io/advisories/CVE-2026-82646.md) `CVE-2026-82646` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS) - [Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution](https://agentprime.io/advisories/CVE-2026-82642.md) `CVE-2026-82642` · CVE record: readest readest · CVSS 8.8 High · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS) - [Beetel 450TC3 User Management cross site scripting](https://agentprime.io/advisories/CVE-2026-82488.md) `CVE-2026-82488` · CVE record: Beetel 450TC3 · CVSS 5.1 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82483.md) `CVE-2026-82483` · CVE record: coppermine-gallery Coppermine Photo Gallery · CVSS 5.1 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82482.md) `CVE-2026-82482` · CVE record: coppermine-gallery Coppermine Photo Gallery · CVSS 5.1 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection - [Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field](https://agentprime.io/advisories/CVE-2026-81660.md) `CVE-2026-81660` · CVE record: Unknown Groundhogg — CRM, Newsletters, and Marketing Automation · CVSS 8.8 High · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS) - [MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List](https://agentprime.io/advisories/CVE-2026-78364.md) `CVE-2026-78364` · CVE record: Unknown MW WP Form · CVSS 3.5 Low · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS) - [Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter](https://agentprime.io/advisories/CVE-2026-76585.md) `CVE-2026-76585` · CVE record: Unknown Customer Reviews for WooCommerce · CVSS 8.8 High · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS) - [Geotargeting WP < 3.5.6.2 - Reflected XSS](https://agentprime.io/advisories/CVE-2026-14307.md) `CVE-2026-14307` · CVE record: Unknown geotargetingwp · CVSS 7.1 High · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS) - [SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox](https://agentprime.io/advisories/CVE-2026-14835.md) `CVE-2026-14835` · CVE record: Unknown SOGO Add Script to Individual Pages Header Footer · CVSS 6.8 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS) - [Formwork < 2.3.11 Stored XSS via Referer Header](https://agentprime.io/advisories/CVE-2026-82451.md) `CVE-2026-82451` · CVE record: getformwork Formwork · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: Cross-site scripting (XSS) - [Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode](https://agentprime.io/advisories/CVE-2026-76546.md) `CVE-2026-76546` · CVE record: Unknown User Profile Builder · CVSS 6.8 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: Cross-site scripting (XSS) - [silverstripe/versioned has XSS in archive admin restore](https://agentprime.io/advisories/GHSA-m4g4-86qc-v8w7.md) `GHSA-m4g4-86qc-v8w7`, `CVE-2026-55779`, `PKSA-nksq-cxj8-zb32` · Packagist `silverstripe/versioned`: affected `<3.2.1`, fixed in `3.2.1` · CVSS 5.4 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction](https://agentprime.io/advisories/GHSA-f2xf-7x3g-4272.md) `GHSA-f2xf-7x3g-4272`, `CVE-2026-55696`, `PKSA-ysv6-x4qh-fd9v` · Packagist `privatebin/privatebin`: affected `<2.0.5`, fixed in `2.0.5` · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports](https://agentprime.io/advisories/CVE-2026-76798.md) `CVE-2026-76798` · CVE record: MongoDB BI Connector Transition Readiness Report · CVSS 6.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata](https://agentprime.io/advisories/CVE-2026-76794.md) `CVE-2026-76794` · CVE record: MongoDB BI Connector Transition Readiness Report · CVSS 4.8 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [Snipe-IT has CSS Injection via \`header_color\` Setting](https://agentprime.io/advisories/GHSA-w7qw-5wfv-gwx9.md) `GHSA-w7qw-5wfv-gwx9`, `CVE-2026-55481`, `PKSA-78g8-kyjb-j6v1` · Packagist `snipe/snipe-it`: affected `<8.6.2`, fixed in `8.6.2` · CVSS 6.2 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [Snipe-IT vulnerable to stored XSS via inline-served attachment](https://agentprime.io/advisories/GHSA-jhph-5q74-pmfx.md) `GHSA-jhph-5q74-pmfx`, `CVE-2026-55466`, `PKSA-3mmm-zfys-jjqm` · Packagist `snipe/snipe-it`: affected `<8.6.2`, fixed in `8.6.2` · CVSS 6.2 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [Snipe-IT vulnerable to stored XSS via Markdown custom field](https://agentprime.io/advisories/GHSA-r52f-r9v5-66xr.md) `GHSA-r52f-r9v5-66xr`, `CVE-2026-55464`, `PKSA-6ddj-s9z1-gtxr` · Packagist `snipe/snipe-it`: affected `<8.6.2`, fixed in `8.6.2` · CVSS 4.8 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [Yamcs has DOM XSS in Extension Routing](https://agentprime.io/advisories/GHSA-9272-wg2r-7xmx.md) `GHSA-9272-wg2r-7xmx`, `CVE-2026-55566` · Maven `org.yamcs:yamcs-core`: affected `>=5.13.0, <5.13.2 || <5.12.8`, fixed in `5.13.2`, `5.12.8` · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [Yamcs has Reflected XSS in the URL of the Authorize Endpoint](https://agentprime.io/advisories/GHSA-rxpg-wjf8-qv9c.md) `GHSA-rxpg-wjf8-qv9c`, `CVE-2026-55549` · Maven `org.yamcs:yamcs-core`: affected `<5.9.4`, fixed in `5.9.4` · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS in Akıllı Ticaret's E-Commerce Pack](https://agentprime.io/advisories/CVE-2026-4378.md) `CVE-2026-4378` · CVE record: Akilli Ticaret Software Technologies Ltd. E-Commerce Pack · CVSS 5.4 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81760.md) `CVE-2026-81760` · CVE record: Crocoblock JetEngine · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [Reflected XSS in Ceviz Informatics's Web Design](https://agentprime.io/advisories/CVE-2026-5953.md) `CVE-2026-5953` · CVE record: Ceviz Informatics Inc. Web Design · CVSS 6.1 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [Reflected XSS in Dayneks Software's E-Commerce Platform](https://agentprime.io/advisories/CVE-2026-5800.md) `CVE-2026-5800` · CVE record: Dayneks Software Industry and Trade Inc. E-Commerce Platform · CVSS 6.1 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) - [Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form](https://agentprime.io/advisories/CVE-2026-6176.md) `CVE-2026-6176` · CVE record: ivole Customer Reviews for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .