# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0](https://agentprime.io/advisories/CVE-2026-88852.md)
  `CVE-2026-88852` · CVE record: regularlabs.com Snippets (Free) extension for Joomla and 1 more · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5](https://agentprime.io/advisories/CVE-2026-85190.md)
  `CVE-2026-85190` · CVE record: regularlabs.com Quick Index (Free, Pro) extension for Joomla · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0](https://agentprime.io/advisories/CVE-2026-85189.md)
  `CVE-2026-85189` · CVE record: regularlabs.com Modals (Free, Pro) extension for Joomla · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0](https://agentprime.io/advisories/CVE-2026-85195.md)
  `CVE-2026-85195` · CVE record: regularlabs.com Articles Anywhere (Free, Pro) extension for Joomla · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0](https://agentprime.io/advisories/CVE-2026-88853.md)
  `CVE-2026-88853` · CVE record: regularlabs.com Modals (Pro) extension for Joomla · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0](https://agentprime.io/advisories/CVE-2026-85191.md)
  `CVE-2026-85191` · CVE record: regularlabs.com Tabs & Accordions (Free, Pro) extension for Joomla · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SourceCodester Class and Exam Timetabling System subject1.php cross site scripting](https://agentprime.io/advisories/CVE-2026-90615.md)
  `CVE-2026-90615` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Cross-site scripting in MediaWiki MassMessage](https://agentprime.io/advisories/CVE-2024-23176.md)
  `CVE-2024-23176` · CVE record: MediaWiki MassMessage · CVSS 5.4 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Frappe](https://agentprime.io/advisories/CVE-2023-51769.md)
  `CVE-2023-51769` · CVE record: Frappe Frappe · CVSS 6.1 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Paessler PRTG Network Monitor](https://agentprime.io/advisories/CVE-2023-28148.md)
  `CVE-2023-28148` · CVE record: Paessler PRTG Network Monitor · CVSS 7.2 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Totolink A3002MU Anchor Tag cross site scripting](https://agentprime.io/advisories/CVE-2026-90604.md)
  `CVE-2026-90604` · CVE record: Totolink A3002MU · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting](https://agentprime.io/advisories/CVE-2026-90602.md)
  `CVE-2026-90602` · CVE record: Anil-matcha Open-Generative-AI · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server](https://agentprime.io/advisories/CVE-2026-88793.md)
  `CVE-2026-88793` · CVE record: Unknown YouTube Embed · CVSS 8.8 High · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import](https://agentprime.io/advisories/CVE-2026-85129.md)
  `CVE-2026-85129` · CVE record: Unknown Hoo Companion · CVSS 8.8 High · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS)
- [kagisearch smallweb Query String Rendering sw.py index cross site scripting](https://agentprime.io/advisories/CVE-2026-90583.md)
  `CVE-2026-90583` · CVE record: kagisearch smallweb · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Exrick xmall Order Printing order-print.jsp cross site scripting](https://agentprime.io/advisories/CVE-2026-90571.md)
  `CVE-2026-90571` · CVE record: Exrick xmall · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting](https://agentprime.io/advisories/CVE-2026-90570.md)
  `CVE-2026-90570` · CVE record: linlinjava litemall · CVSS 4.8 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting](https://agentprime.io/advisories/CVE-2026-90569.md)
  `CVE-2026-90569` · CVE record: linlinjava litemall · CVSS 4.8 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting](https://agentprime.io/advisories/CVE-2026-90568.md)
  `CVE-2026-90568` · CVE record: moxi624 Mogu Blog v2 · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting](https://agentprime.io/advisories/CVE-2026-90567.md)
  `CVE-2026-90567` · CVE record: quequnlong shiyi-blog · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting](https://agentprime.io/advisories/CVE-2026-90564.md)
  `CVE-2026-90564` · CVE record: quequnlong shiyi-blog · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting](https://agentprime.io/advisories/CVE-2026-90563.md)
  `CVE-2026-90563` · CVE record: maliangnansheng bbs-springboot · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting](https://agentprime.io/advisories/CVE-2026-90529.md)
  `CVE-2026-90529` · CVE record: DataEase · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [TDuckApp tduck-platform Form Write View index.vue cross site scripting](https://agentprime.io/advisories/CVE-2026-90528.md)
  `CVE-2026-90528` · CVE record: TDuckApp tduck-platform · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [quequnlong shiyi-blog Add Message API index.vue cross site scripting](https://agentprime.io/advisories/CVE-2026-90527.md)
  `CVE-2026-90527` · CVE record: quequnlong shiyi-blog · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Amundsen Frontend through 4.3.0 Stored XSS via Description](https://agentprime.io/advisories/CVE-2026-90772.md)
  `CVE-2026-90772` · CVE record: amundsen-io amundsen-frontend · CVSS 8.3 High · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG](https://agentprime.io/advisories/CVE-2026-90561.md)
  `CVE-2026-90561` · CVE record: strapi strapi · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS)
- [stilleshan ServerStatus Stats Generation main.cpp cross site scripting](https://agentprime.io/advisories/CVE-2026-90502.md)
  `CVE-2026-90502` · CVE record: stilleshan ServerStatus · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting](https://agentprime.io/advisories/CVE-2026-90497.md)
  `CVE-2026-90497` · CVE record: Fengoffice Feng Office · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Cross-site scripting in Grav](https://agentprime.io/advisories/CVE-2025-64059.md)
  `CVE-2025-64059` · CVE record: getgrav Grav · CVSS 1.8 Low · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Repetico web backend](https://agentprime.io/advisories/CVE-2025-63842.md)
  `CVE-2025-63842` · CVE record: Repetico web backend · CVSS 5.4 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Xuxueli xxl-job insert cross site scripting](https://agentprime.io/advisories/CVE-2026-90489.md)
  `CVE-2026-90489` · CVE record: Xuxueli xxl-job · CVSS 5.1 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter](https://agentprime.io/advisories/CVE-2026-10148.md)
  `CVE-2026-10148` · CVE record: melograno Booking for Appointments and Events Calendar – Amelia · CVSS 6.4 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Cross-site scripting (XSS)
- [YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route](https://agentprime.io/advisories/CVE-2026-87888.md)
  `CVE-2026-87888` · CVE record: Unknown YayPricing · CVSS 8.0 High · Not analysed yet · Published 12 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode](https://agentprime.io/advisories/CVE-2026-86790.md)
  `CVE-2026-86790` · CVE record: Unknown WP Highlight Box · CVSS 6.8 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights](https://agentprime.io/advisories/CVE-2026-82847.md)
  `CVE-2026-82847` · CVE record: Unknown Masteriyo LMS · CVSS 6.8 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Cross-site scripting (XSS)
- [BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation](https://agentprime.io/advisories/CVE-2026-81742.md)
  `CVE-2026-81742` · CVE record: Unknown BE REST Endpoints · CVSS 8.8 High · Not analysed yet · Published 12 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF](https://agentprime.io/advisories/CVE-2026-81429.md)
  `CVE-2026-81429` · CVE record: Unknown Export & Import WPBakery Page Builder · CVSS 7.1 High · Not analysed yet · Published 12 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-83532.md)
  `CVE-2026-83532` · CVE record: Unknown Custom Menu Wizard Widget · CVSS 6.8 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Cross-site scripting (XSS)
- [QloApps through 1.7.0 Reflected XSS via List Filter Parameters](https://agentprime.io/advisories/CVE-2026-89268.md)
  `CVE-2026-89268` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting in Malcolm](https://agentprime.io/advisories/CVE-2026-90443.md)
  `CVE-2026-90443` · CVE record: CISA Malcolm · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)](https://agentprime.io/advisories/CVE-2026-54165.md)
  `CVE-2026-54165` · CVE record: smgdkngt dobase · CVSS 6.4 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block](https://agentprime.io/advisories/CVE-2026-81918.md)
  `CVE-2026-81918` · CVE record: Concrete CMS Concrete CMS · CVSS 4.8 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags](https://agentprime.io/advisories/CVE-2026-81917.md)
  `CVE-2026-81917` · CVE record: Concrete CMS Concrete CMS · CVSS 5.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-77490.md)
  `CVE-2026-77490` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description](https://agentprime.io/advisories/CVE-2026-81911.md)
  `CVE-2026-81911` · CVE record: Concrete CMS Concrete CMS · CVSS 5.8 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62138.md)
  `CVE-2026-62138` · CVE record: Visual Composer Visual Composer Website Builder · CVSS 6.5 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62111.md)
  `CVE-2026-62111` · CVE record: Ido Kobelkowsky Simple Payment · CVSS 6.5 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62110.md)
  `CVE-2026-62110` · CVE record: boldthemes Bold Page Builder · CVSS 6.5 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title](https://agentprime.io/advisories/CVE-2026-68528.md)
  `CVE-2026-68528` · CVE record: Concrete CMS Concrete CMS · CVSS 6.0 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Reflected XSS in IdeaSoft's Smart E-Commerce](https://agentprime.io/advisories/CVE-2026-7298.md)
  `CVE-2026-7298` · CVE record: IdeaSoft Software Industry and Trade Inc. Smart E-Commerce · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo LMS Stored XSS via Survey Answer Submission in reporting.php](https://agentprime.io/advisories/CVE-2026-82535.md)
  `CVE-2026-82535` · CVE record: chamilo chamilo-lms · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo Bookmark Plugin Stored XSS via Chapter Names](https://agentprime.io/advisories/CVE-2026-89256.md)
  `CVE-2026-89256` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo LoginControl Stored XSS via PGP Public Key](https://agentprime.io/advisories/CVE-2026-89255.md)
  `CVE-2026-89255` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo CustomizeUser Stored XSS via field_name Parameter](https://agentprime.io/advisories/CVE-2026-89254.md)
  `CVE-2026-89254` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo Stored XSS via donationLink in watch page button](https://agentprime.io/advisories/CVE-2026-89253.md)
  `CVE-2026-89253` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo YPTWallet Stored XSS via CryptoWallet Configuration](https://agentprime.io/advisories/CVE-2026-89249.md)
  `CVE-2026-89249` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo Reflected XSS via Gallery Category getBackURL](https://agentprime.io/advisories/CVE-2026-89244.md)
  `CVE-2026-89244` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo Stored XSS via UserGroups setGroup_name](https://agentprime.io/advisories/CVE-2026-89243.md)
  `CVE-2026-89243` · CVE record: WWBN AVideo · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo Reflected XSS via confirmLivePassword.php](https://agentprime.io/advisories/CVE-2026-89241.md)
  `CVE-2026-89241` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTA5LTExVDExOjE1OjIyLjM1OTAwMFoiLCJDVkUtMjAyNi04OTI0MSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTA5LTE0VDA2OjIxOjE4LjcxMDAwMFoiLCJDVkUtMjAyNi04NTE5NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTA5LTE0VDA2OjIxOjE4LjcxMDAwMFoiLCJDVkUtMjAyNi04NTE5NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.