# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block](https://agentprime.io/advisories/CVE-2026-82884.md) `CVE-2026-82884` · CVE record: Unknown All in One SEO · CVSS 6.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Icegram Express < 5.8.6 - Admin+ Stored XSS](https://agentprime.io/advisories/CVE-2025-15692.md) `CVE-2025-15692` · CVE record: Unknown Icegram Express · CVSS 3.5 Low · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094](https://agentprime.io/advisories/CVE-2026-18986.md) `CVE-2026-18986` · CVE record: Drupal Entity Browser · CVSS 4.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102](https://agentprime.io/advisories/CVE-2026-76782.md) `CVE-2026-76782` · CVE record: Drupal Screenshot · CVSS 7.3 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload - [Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102](https://agentprime.io/advisories/CVE-2026-76759.md) `CVE-2026-76759` · CVE record: Drupal Screenshot · CVSS 7.3 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103](https://agentprime.io/advisories/CVE-2026-81167.md) `CVE-2026-81167` · CVE record: Drupal Address Suggestion · CVSS 4.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116](https://agentprime.io/advisories/CVE-2026-81201.md) `CVE-2026-81201` · CVE record: Drupal Monster Menus · CVSS 6.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117](https://agentprime.io/advisories/CVE-2026-81160.md) `CVE-2026-81160` · CVE record: Drupal Slick Carousel · CVSS 6.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-83562.md) `CVE-2026-83562` · CVE record: WC Lovers WCFM Marketplace · CVSS 6.5 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81775.md) `CVE-2026-81775` · CVE record: Estatik Estatik · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81771.md) `CVE-2026-81771` · CVE record: TrustedSite TrustedSite · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81770.md) `CVE-2026-81770` · CVE record: MapGeo Interactive Geo Maps · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81289.md) `CVE-2026-81289` · CVE record: sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81288.md) `CVE-2026-81288` · CVE record: WP Swings Upsell Order Bump Offer for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84781.md) `CVE-2026-84781` · CVE record: WP Chill Gallery PhotoBlocks · CVSS 6.5 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege e...](https://agentprime.io/advisories/GHSA-9437-39hj-3c93.md) `GHSA-9437-39hj-3c93`, `BIT-spark-2026-32773`, `CVE-2026-32773`, `PYSEC-2026-3966` · PyPI `pyspark`: affected `>=3.0.0, <3.5.8`, fixed in `3.5.8` · CVSS 6.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist](https://agentprime.io/advisories/CVE-2026-84803.md) `CVE-2026-84803` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name](https://agentprime.io/advisories/CVE-2026-84793.md) `CVE-2026-84793` · CVE record: craftcms cms · CVSS 4.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log](https://agentprime.io/advisories/CVE-2026-75528.md) `CVE-2026-75528` · CVE record: wpmudev Broken Link Checker · CVSS 7.2 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function](https://agentprime.io/advisories/CVE-2025-7963.md) `CVE-2025-7963` · CVE record: tymotey Easy Waveform Player · CVSS 6.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-82883.md) `CVE-2026-82883` · CVE record: Marcus Login With Ajax · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter](https://agentprime.io/advisories/CVE-2026-3850.md) `CVE-2026-3850` · CVE record: Elegant Themes Divi · CVSS 6.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification](https://agentprime.io/advisories/CVE-2026-81807.md) `CVE-2026-81807` · CVE record: Unknown Simple Ajax Chat · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information](https://agentprime.io/advisories/CVE-2026-81737.md) `CVE-2026-81737` · CVE record: Unknown FAQ Builder AYS · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field](https://agentprime.io/advisories/CVE-2026-77792.md) `CVE-2026-77792` · CVE record: Unknown RegistrationMagic · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler](https://agentprime.io/advisories/CVE-2026-19723.md) `CVE-2026-19723` · CVE record: Unknown Social Media Share Buttons & Social Sharing Icons · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Contributor+ Stored XSS via Post Title](https://agentprime.io/advisories/CVE-2026-19719.md) `CVE-2026-19719` · CVE record: Unknown Social Media Share Buttons & Social Sharing Icons · CVSS 6.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters](https://agentprime.io/advisories/CVE-2026-12865.md) `CVE-2026-12865` · CVE record: Unknown Photo Gallery by 10Web · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [BEAF < 4.7.19 - Author+ Stored XSS via Before Label](https://agentprime.io/advisories/CVE-2025-15664.md) `CVE-2025-15664` · CVE record: Unknown Ultimate Before After Image Slider & Gallery · CVSS 6.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [BEAF < 4.7.19 - Author+ Stored XSS via After Label](https://agentprime.io/advisories/CVE-2025-15663.md) `CVE-2025-15663` · CVE record: Unknown Ultimate Before After Image Slider & Gallery · CVSS 6.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode](https://agentprime.io/advisories/CVE-2026-3851.md) `CVE-2026-3851` · CVE record: Elegant Themes Divi · CVSS 6.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [OpenCart Autocomplete Workflow edit.php cross site scripting](https://agentprime.io/advisories/CVE-2026-84438.md) `CVE-2026-84438` · CVE record: OpenCart · CVSS 5.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [OpenCart Autocomplete Workflow address.php cross site scripting](https://agentprime.io/advisories/CVE-2026-84437.md) `CVE-2026-84437` · CVE record: OpenCart · CVSS 5.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [NocoBase Rich Text Field Stored Cross-Site Scripting via API](https://agentprime.io/advisories/CVE-2026-84701.md) `CVE-2026-84701` · CVE record: nocobase nocobase · CVSS 5.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [BookStack before 26.05.4 Stored XSS via Drawing Upload](https://agentprime.io/advisories/CVE-2026-84695.md) `CVE-2026-84695` · CVE record: bookstackapp bookstack · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS) - [AVideo Stored XSS via Live Schedule Title Description](https://agentprime.io/advisories/CVE-2026-84477.md) `CVE-2026-84477` · CVE record: WWBN AVideo · CVSS 5.1 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass](https://agentprime.io/advisories/GHSA-g8qq-57p8-ggw5.md) `GHSA-g8qq-57p8-ggw5`, `CVE-2026-84371` · npm `sanitize-html`: affected `>=1.9.0, <2.17.7`, fixed in `2.17.7` · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module](https://agentprime.io/advisories/CVE-2026-73524.md) `CVE-2026-73524` · CVE record: cypht-org cypht · CVSS 5.1 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-73781.md) `CVE-2026-73781` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 8.4 High · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [league/commonmark XSS: \`on\*\` event-handler filter in \`AttributesExtension\` bypassed with a U+000C form feed](https://agentprime.io/advisories/GHSA-f8fg-pg57-v4j8.md) `GHSA-f8fg-pg57-v4j8`, `CVE-2026-86431`, `PKSA-kr3s-894t-g5w2` · Packagist `league/commonmark`: affected `>=2.7.0, <2.9.1`, fixed in `2.9.1` · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-86 - [Unauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-73731.md) `CVE-2026-73731` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 6.1 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-73703.md) `CVE-2026-73703` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-73700.md) `CVE-2026-73700` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig\* routes](https://agentprime.io/advisories/GHSA-3wgp-x9p5-c7cc.md) `GHSA-3wgp-x9p5-c7cc`, `CVE-2026-58191` · npm `@appium/base-driver`: affected `<10.7.0`, fixed in `10.7.0` · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-489 - [Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content](https://agentprime.io/advisories/CVE-2026-84232.md) `CVE-2026-84232` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 and 3 more · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Rockwell Automation ArmorStart® LT Stored Cross-site scripting](https://agentprime.io/advisories/CVE-2026-19471.md) `CVE-2026-19471` · CVE record: Rockwell Automation ArmorStart® LT · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [WP Recipe Maker Premium <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode](https://agentprime.io/advisories/CVE-2026-7877.md) `CVE-2026-7877` · CVE record: Bootstrapped Ventures WP Recipe Maker Premium · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP](https://agentprime.io/advisories/CVE-2026-84193.md) `CVE-2026-84193` · CVE record: librenms librenms · CVSS 5.8 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields](https://agentprime.io/advisories/CVE-2026-84191.md) `CVE-2026-84191` · CVE record: librenms librenms · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter](https://agentprime.io/advisories/CVE-2026-15101.md) `CVE-2026-15101` · CVE record: wpbakery WPBakery Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode](https://agentprime.io/advisories/CVE-2026-16788.md) `CVE-2026-16788` · CVE record: livecomposer Live Composer – Free WordPress Website Builder · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode](https://agentprime.io/advisories/CVE-2026-16786.md) `CVE-2026-16786` · CVE record: livecomposer Live Composer – Free WordPress Website Builder · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter](https://agentprime.io/advisories/CVE-2026-19914.md) `CVE-2026-19914` · CVE record: uscnanbu Welcart e-Commerce · CVSS 7.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)](https://agentprime.io/advisories/CVE-2026-18488.md) `CVE-2026-18488` · CVE record: creativethemeshq Blocksy Companion · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content](https://agentprime.io/advisories/CVE-2026-75980.md) `CVE-2026-75980` · CVE record: wpdevteam BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter](https://agentprime.io/advisories/CVE-2026-75964.md) `CVE-2026-75964` · CVE record: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 6.1 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-12747.md) `CVE-2026-12747` · CVE record: shabti Frontend Admin by DynamiApps · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Affiliate Super Assistent <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function](https://agentprime.io/advisories/CVE-2026-19573.md) `CVE-2026-19573` · CVE record: worschtebrot Affiliate Super Assistent · CVSS 7.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-13203.md) `CVE-2026-13203` · CVE record: livecomposer Live Composer – Free WordPress Website Builder · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) - [Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode](https://agentprime.io/advisories/CVE-2026-16787.md) `CVE-2026-16787` · CVE record: livecomposer Live Composer – Free WordPress Website Builder · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .