# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Cross-site scripting in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-40534.md) `CVE-2026-40534` · CVE record: Synology DiskStation Manager (DSM) · CVSS 5.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-13623.md) `CVE-2026-13623` · CVE record: Synology DiskStation Manager (DSM) · CVSS 4.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Reflected XSS in KA Informatics' Bar Association Website](https://agentprime.io/advisories/CVE-2026-11757.md) `CVE-2026-11757` · CVE record: KA Informatics Technologies Ltd. Co. Bar Association Website · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67103.md) `CVE-2026-67103` · CVE record: HCL Software HCL BigFix Service Management · CVSS 7.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter](https://agentprime.io/advisories/CVE-2026-92249.md) `CVE-2026-92249` · CVE record: qodeinteractive Qi Addons For Elementor · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-15004.md) `CVE-2026-15004` · CVE record: ninjateam FileBird – WordPress Media Library Folders & File Manager · CVSS 5.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content](https://agentprime.io/advisories/CVE-2026-14472.md) `CVE-2026-14472` · CVE record: extendthemes Kubio AI Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-92622.md) `CVE-2026-92622` · CVE record: wpchill Strong Testimonials · CVSS 6.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter](https://agentprime.io/advisories/CVE-2026-90981.md) `CVE-2026-90981` · CVE record: satollo Newsletter – Send awesome emails from WordPress · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name](https://agentprime.io/advisories/CVE-2026-92554.md) `CVE-2026-92554` · CVE record: devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta](https://agentprime.io/advisories/CVE-2026-17586.md) `CVE-2026-17586` · CVE record: kurudrive VK All in One Expansion Unit · CVSS 6.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [QcalAgent](https://agentprime.io/advisories/CVE-2024-27123.md) `CVE-2024-27123` · CVE record: QNAP Systems Inc. QcalAgent · CVSS 5.2 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter](https://agentprime.io/advisories/CVE-2026-92561.md) `CVE-2026-92561` · CVE record: wpdevelop Booking Calendar · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters](https://agentprime.io/advisories/CVE-2026-89330.md) `CVE-2026-89330` · CVE record: wpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-84909.md) `CVE-2026-84909` · CVE record: smub Custom Twitter Feeds – A Tweets Widget or X Feed Widget · CVSS 6.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute](https://agentprime.io/advisories/CVE-2026-75016.md) `CVE-2026-75016` · CVE record: wpblockart Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid · CVSS 6.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute](https://agentprime.io/advisories/CVE-2026-88993.md) `CVE-2026-88993` · CVE record: Unknown All Bootstrap Blocks · CVSS 6.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings](https://agentprime.io/advisories/CVE-2026-88825.md) `CVE-2026-88825` · CVE record: Unknown iGMS Direct Booking · CVSS 8.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment](https://agentprime.io/advisories/CVE-2026-85127.md) `CVE-2026-85127` · CVE record: Unknown VikBooking Hotel Booking Engine & PMS · CVSS 8.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion](https://agentprime.io/advisories/CVE-2026-85122.md) `CVE-2026-85122` · CVE record: Unknown Easy Form Builder by WhiteStudio · CVSS 8.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import](https://agentprime.io/advisories/CVE-2026-84902.md) `CVE-2026-84902` · CVE record: Unknown King Addons for Elementor · CVSS 6.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-93485.md) `CVE-2026-93485` · CVE record: Automattic WordPress · CVSS 7.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API](https://agentprime.io/advisories/CVE-2026-92991.md) `CVE-2026-92991` · CVE record: bdthemes Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action](https://agentprime.io/advisories/CVE-2026-14855.md) `CVE-2026-14855` · CVE record: themewant RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg · CVSS 6.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute](https://agentprime.io/advisories/CVE-2026-15650.md) `CVE-2026-15650` · CVE record: themewant RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg · CVSS 6.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component](https://agentprime.io/advisories/CVE-2026-79294.md) `CVE-2026-79294` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter](https://agentprime.io/advisories/CVE-2026-2585.md) `CVE-2026-2585` · CVE record: themefusecom Brizy – Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [Aureus ERP through 1.6.0 Stored XSS via Payment Term Note](https://agentprime.io/advisories/CVE-2026-93454.md) `CVE-2026-93454` · CVE record: Webkul Aureus ERP · CVSS 5.1 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [Azure Portal Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-83946.md) `CVE-2026-83946` · CVE record: Microsoft Azure Portal · CVSS 8.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass](https://agentprime.io/advisories/CVE-2026-54645.md) `CVE-2026-54645` · CVE record: cubecart v6 · CVSS 4.8 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System](https://agentprime.io/advisories/CVE-2026-54644.md) `CVE-2026-54644` · CVE record: cubecart v6 · CVSS 6.1 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field](https://agentprime.io/advisories/CVE-2026-54506.md) `CVE-2026-54506` · CVE record: givanz Vvveb · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-185 - [Stored XSS via SVG Upload](https://agentprime.io/advisories/CVE-2026-53555.md) `CVE-2026-53555` · CVE record: dataease SQLBot · CVSS 5.1 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate](https://agentprime.io/advisories/GHSA-q2j8-x8hf-63ch.md) `GHSA-q2j8-x8hf-63ch`, `CVE-2026-75834`, `PKSA-ht1d-wm6t-8sdj` · Packagist `getgrav/grav`: affected `<2.0.14`, fixed in `2.0.14` · CVSS 5.1 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS](https://agentprime.io/advisories/GHSA-vfmf-q6x9-cw96.md) `GHSA-vfmf-q6x9-cw96`, `CVE-2026-75828`, `PKSA-tr1n-vmpf-rmt6` · Packagist `getgrav/grav`: affected `<2.0.15`, fixed in `2.0.15` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [@platejs/core HTML deserialization can trigger browser behavior during parsing](https://agentprime.io/advisories/GHSA-qrfj-mgw8-j9c6.md) `GHSA-qrfj-mgw8-j9c6`, `CVE-2026-88976` · npm `@platejs/core`: affected `<53.3.11 || >=54.0.0-beta.0, <=54.0.0-beta.1`, fixed in `53.3.11` · CVSS 6.1 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [djust: A template binding inherits a context safety grant it never earned (XSS)](https://agentprime.io/advisories/GHSA-xjw9-38cr-6372.md) `GHSA-xjw9-38cr-6372`, `CVE-2026-125112` · PyPI `djust`: affected `<1.0.10 || >=1.1.0, <1.1.2`, fixed in `1.0.10`, `1.1.2` · CVSS 2.3 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)](https://agentprime.io/advisories/GHSA-9395-2g46-rj3f.md) `GHSA-9395-2g46-rj3f` · PyPI `djust`: affected `<1.1.1`, fixed in `1.1.1` · No CVSS score · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [MapServer: Reflected XSS in OpenLayers HTML Output via \`HTTP_X_FORWARDED_HOST\`](https://agentprime.io/advisories/CVE-2026-54355.md) `CVE-2026-54355` · CVE record: MapServer MapServer · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [CVE-2026-76154 CVE Record](https://agentprime.io/advisories/CVE-2026-76154.md) `CVE-2026-76154` · CVE record: Grafana Grafana OSS and 1 more · CVSS 7.3 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)](https://agentprime.io/advisories/CVE-2026-54521.md) `CVE-2026-54521` · CVE record: M66B FairEmail · CVSS 6.1 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [Chamilo LMS: Student-to-admin stored XSS in private messages via v-html](https://agentprime.io/advisories/CVE-2026-45143.md) `CVE-2026-45143` · CVE record: chamilo chamilo-lms · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [TS3 Manager: Reflected XSS via /api/download port parameter steals operator session](https://agentprime.io/advisories/CVE-2026-54253.md) `CVE-2026-54253` · CVE record: joni1802 ts3-manager · CVSS 8.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [Grav: Stored XSS via Markdown audio/video media \ URL](https://agentprime.io/advisories/GHSA-6qw9-4vv5-jr97.md) `GHSA-6qw9-4vv5-jr97`, `CVE-2026-75831`, `PKSA-12j4-4z12-p48k` · Packagist `getgrav/grav`: affected `<2.0.15`, fixed in `2.0.15` · CVSS 5.1 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [Grav: Stored XSS via quoted-attribute bypass in detectXss](https://agentprime.io/advisories/GHSA-269c-h76q-8cxw.md) `GHSA-269c-h76q-8cxw`, `CVE-2026-72832`, `PKSA-rstv-2c4g-sjjn` · Packagist `getgrav/grav`: affected `>=1.5.2, <2.0.13`, fixed in `2.0.13` · CVSS 5.1 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends](https://agentprime.io/advisories/CVE-2026-93296.md) `CVE-2026-93296` · CVE record: misp misp · CVSS 8.5 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions](https://agentprime.io/advisories/GHSA-xhq9-whgq-49j5.md) `GHSA-xhq9-whgq-49j5`, `CVE-2026-63459` · npm `@vendure/dashboard`: affected `<3.6.5`, fixed in `3.6.5` · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [SiYuan before 3.8.4 Cross-Site Scripting via Document Title](https://agentprime.io/advisories/CVE-2026-92986.md) `CVE-2026-92986` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels](https://agentprime.io/advisories/CVE-2026-92985.md) `CVE-2026-92985` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8](https://agentprime.io/advisories/CVE-2026-92973.md) `CVE-2026-92973` · CVE record: pycontribs ansi2html · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-90887.md) `CVE-2026-90887` · CVE record: WP Inventory WP Inventory Manager · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-78294.md) `CVE-2026-78294` · CVE record: Dylan Kuhn Geo Mashup · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66617.md) `CVE-2026-66617` · CVE record: PublishPress PublishPress Series · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66579.md) `CVE-2026-66579` · CVE record: Crocoblock. Jetimpex Inc. JetElements For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66578.md) `CVE-2026-66578` · CVE record: Property Hive PropertyHive · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66577.md) `CVE-2026-66577` · CVE record: Crocoblock. Jetimpex Inc. JetSearch · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66576.md) `CVE-2026-66576` · CVE record: Crocoblock. Jetimpex Inc. JetBlocks For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66574.md) `CVE-2026-66574` · CVE record: bdthemes Element Pack Elementor Addons · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66573.md) `CVE-2026-66573` · CVE record: Crocoblock. Jetimpex Inc. JetTabs · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66572.md) `CVE-2026-66572` · CVE record: Crocoblock. Jetimpex Inc. JetBlog · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .