# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WWBN AVideo Reflected XSS via confirmLivePassword.php](https://agentprime.io/advisories/CVE-2026-89240.md)
  `CVE-2026-89240` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo Reflected XSS via Referer Header Comment Breakout](https://agentprime.io/advisories/CVE-2026-89239.md)
  `CVE-2026-89239` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter](https://agentprime.io/advisories/CVE-2026-17037.md)
  `CVE-2026-17037` · CVE record: themeum Kirki – Freeform Page Builder, Website Builder & Customizer · CVSS 7.2 High · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter](https://agentprime.io/advisories/CVE-2026-6640.md)
  `CVE-2026-6640` · CVE record: dglingren Media Library Assistant · CVSS 6.4 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import](https://agentprime.io/advisories/CVE-2026-6642.md)
  `CVE-2026-6642` · CVE record: dglingren Media Library Assistant · CVSS 6.4 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter](https://agentprime.io/advisories/CVE-2026-6641.md)
  `CVE-2026-6641` · CVE record: dglingren Media Library Assistant · CVSS 6.4 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text](https://agentprime.io/advisories/CVE-2026-86780.md)
  `CVE-2026-86780` · CVE record: Unknown Featured Image with URL · CVSS 6.8 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript](https://agentprime.io/advisories/CVE-2026-85678.md)
  `CVE-2026-85678` · CVE record: Unknown AI Builder · CVSS 6.8 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content](https://agentprime.io/advisories/CVE-2026-85677.md)
  `CVE-2026-85677` · CVE record: Unknown Gutenverse News · CVSS 8.8 High · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration](https://agentprime.io/advisories/CVE-2026-14565.md)
  `CVE-2026-14565` · CVE record: Unknown advanced-customized-prompts · CVSS 5.4 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [GTranslate < 3.0.10 - Admin+ Stored XSS](https://agentprime.io/advisories/CVE-2025-15695.md)
  `CVE-2025-15695` · CVE record: Unknown Translate WordPress with GTranslate · CVSS 3.5 Low · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute](https://agentprime.io/advisories/CVE-2026-83546.md)
  `CVE-2026-83546` · CVE record: Unknown CoolClock · CVSS 6.8 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON](https://agentprime.io/advisories/CVE-2026-83545.md)
  `CVE-2026-83545` · CVE record: Unknown CoolClock · CVSS 6.8 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-78172.md)
  `CVE-2026-78172` · CVE record: themifyme Themify – WooCommerce Product Filter · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-7438.md)
  `CVE-2026-7438` · CVE record: boldthemes Bold Timeline Lite · CVSS 6.4 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [HUSKY <= 1.4.3 - Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-18562.md)
  `CVE-2026-18562` · CVE record: realmag777 HUSKY – Products Filter for WooCommerce Professional · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Relevanssi <= 4.28.1 - Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-19985.md)
  `CVE-2026-19985` · CVE record: comesio Relevanssi – A Better Search · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-81754.md)
  `CVE-2026-81754` · CVE record: fernandot Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… · CVSS 7.2 High · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-84960.md)
  `CVE-2026-84960` · CVE record: cbutlerjr WP-Members Membership Plugin · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-18964.md)
  `CVE-2026-18964` · CVE record: premio Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-81825.md)
  `CVE-2026-81825` · CVE record: specialk Simple Ajax Chat – Add a Fast, Secure Chat Box · CVSS 7.2 High · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-77150.md)
  `CVE-2026-77150` · CVE record: unitecms Unlimited Elements For Elementor · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-18579.md)
  `CVE-2026-18579` · CVE record: opajaap WP Photo Album Plus · CVSS 7.2 High · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory](https://agentprime.io/advisories/CVE-2026-89145.md)
  `CVE-2026-89145` · CVE record: flextype flextype · CVSS 2.4 Low · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary Javascript in the context of the victim'…](https://agentprime.io/advisories/CVE-2026-79035.md)
  `CVE-2026-79035` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Angular: SSR XSS via Unescaped \<template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements](https://agentprime.io/advisories/GHSA-v3p8-whq6-r5jg.md)
  `GHSA-v3p8-whq6-r5jg`, `CVE-2026-88060` · npm `@angular/platform-server`: affected `<=19.2.25 || >=20.0.0, <20.3.30 || >=21.0.0, <21.2.22 || >=22.0.0, <22.1.4`, fixed in `20.3.30`, `21.2.22`, `22.1.4` · CVSS 8.6 High · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler](https://agentprime.io/advisories/GHSA-hh8m-fm6v-7cvg.md)
  `GHSA-hh8m-fm6v-7cvg`, `CVE-2026-88057` · npm `@angular/compiler` and 1 more: affected `<=19.2.25 || >=20.0.0, <20.3.28 || >=21.0.0, <21.2.20 || >=22.0.0, <22.1.0`, fixed in `20.3.28`, `21.2.20`, `22.1.0` · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator](https://agentprime.io/advisories/CVE-2026-88055.md)
  `CVE-2026-88055` · CVE record: Mintplex-Labs anything-llm · CVSS 5.5 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin](https://agentprime.io/advisories/GHSA-jmc6-2wr8-h3wj.md)
  `GHSA-jmc6-2wr8-h3wj`, `CVE-2026-87995`, `PYSEC-2026-4123` · PyPI `open-webui`: affected `>=0.8.11, <0.11.1`, fixed in `0.11.1` · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-1021
- [@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name](https://agentprime.io/advisories/GHSA-x7m8-jrm8-hpvx.md)
  `GHSA-x7m8-jrm8-hpvx` · npm `@eigenpal/docx-editor-core` and 1 more: affected `<1.8.3`, fixed in `1.8.3` · CVSS 8.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84819.md)
  `CVE-2026-84819` · CVE record: Greg Winiarski WPAdverts · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-84816.md)
  `CVE-2026-84816` · CVE record: RealMag777 WPCS · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81795.md)
  `CVE-2026-81795` · CVE record: Denis Botić Page Visits Counter \&#8211; Lite · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81791.md)
  `CVE-2026-81791` · CVE record: Ashan Perera EventON · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-81782.md)
  `CVE-2026-81782` · CVE record: Fahad Mahmood WP Docs · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored XSS in Ankaref's LIBRID/LIBREF](https://agentprime.io/advisories/CVE-2026-12682.md)
  `CVE-2026-12682` · CVE record: Ankaref Innovation and Technology Inc. LIBRID/LIBREF · CVSS 5.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MISP: Unescaped HTML Injection in PDF Report Element Rendering](https://agentprime.io/advisories/CVE-2026-88921.md)
  `CVE-2026-88921` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Stored XSS Yönetim panel in Ankaref's LIBRID/LIBREF](https://agentprime.io/advisories/CVE-2026-12683.md)
  `CVE-2026-12683` · CVE record: Ankaref Innovation and Technology Inc. LIBRID/LIBREF · CVSS 5.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo AD_Server Stored XSS via log.php label parameter](https://agentprime.io/advisories/CVE-2026-88869.md)
  `CVE-2026-88869` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo LiveLinks Stored XSS via title and description fields](https://agentprime.io/advisories/CVE-2026-88868.md)
  `CVE-2026-88868` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo Stored XSS via Category Name and Icon Class](https://agentprime.io/advisories/CVE-2026-88867.md)
  `CVE-2026-88867` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo LoginControl Stored XSS via User-Agent Header](https://agentprime.io/advisories/CVE-2026-88866.md)
  `CVE-2026-88866` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4](https://agentprime.io/advisories/CVE-2026-78302.md)
  `CVE-2026-78302` · CVE record: joomshaper.com SP Property extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content](https://agentprime.io/advisories/CVE-2026-15889.md)
  `CVE-2026-15889` · CVE record: arubadev Aruba HiSpeed Cache · CVSS 6.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value](https://agentprime.io/advisories/CVE-2026-5399.md)
  `CVE-2026-5399` · CVE record: davidanderson Redux Framework · CVSS 6.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in SHIRASAGI](https://agentprime.io/advisories/CVE-2026-81635.md)
  `CVE-2026-81635` · CVE record: SHIRASAGI Project SHIRASAGI · CVSS 5.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface](https://agentprime.io/advisories/CVE-2026-0308.md)
  `CVE-2026-0308` · CVE record: Palo Alto Networks Cloud NGFW and 2 more · CVSS 1.1 Low · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-85645.md)
  `CVE-2026-85645` · CVE record: 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder · CVSS 6.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter](https://agentprime.io/advisories/CVE-2026-76562.md)
  `CVE-2026-76562` · CVE record: otwthemes Sidebar Manager Light · CVSS 7.2 High · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field](https://agentprime.io/advisories/CVE-2026-4657.md)
  `CVE-2026-4657` · CVE record: sunny_johal Easy Google Fonts · CVSS 6.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting](https://agentprime.io/advisories/CVE-2026-15820.md)
  `CVE-2026-15820` · CVE record: builderall Builderall for WordPress · CVSS 6.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting](https://agentprime.io/advisories/CVE-2026-15796.md)
  `CVE-2026-15796` · CVE record: builderall Builderall for WordPress · CVSS 6.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters](https://agentprime.io/advisories/CVE-2026-87870.md)
  `CVE-2026-87870` · CVE record: Saturday Drive Ninja Forms - Scheduled Exports · CVSS 6.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS).](https://agentprime.io/advisories/CVE-2026-36392.md)
  `CVE-2026-36392` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or mrfAnnouncementNameparame…](https://agentprime.io/advisories/CVE-2022-26962.md)
  `CVE-2022-26962` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Rizwan17 inventory-management-system Login Page index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-87926.md)
  `CVE-2026-87926` · CVE record: Rizwan17 inventory-management-system · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Rizwan17 inventory-management-system List DBOperation.php cross site scripting](https://agentprime.io/advisories/CVE-2026-87923.md)
  `CVE-2026-87923` · CVE record: Rizwan17 inventory-management-system · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover](https://agentprime.io/advisories/CVE-2026-54694.md)
  `CVE-2026-54694` · CVE record: NationalSecurityAgency skills-service · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116, CWE-183
- [decidim-elections: Election question titles allow stored script execution](https://agentprime.io/advisories/GHSA-9mvp-w4rr-5c6x.md)
  `GHSA-9mvp-w4rr-5c6x`, `CVE-2026-44282` · RubyGems `decidim-elections`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 4.8 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [LF Edge eKuiper: Self-XSS in External Service Creation](https://agentprime.io/advisories/GHSA-g8rh-fjm6-h2h9.md)
  `GHSA-g8rh-fjm6-h2h9`, `CVE-2025-24978`, `GO-2026-6446` · Go `github.com/lf-edge/ekuiper/v2`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 3.7 Low · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTA5LTA5VDE3OjU2OjIyLjAwMDAwMFoiLCJHSFNBLWc4cmgtZmptNi1oMmg5Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTA5LTExVDExOjE1OjIyLjM1OTAwMFoiLCJDVkUtMjAyNi04OTI0MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTA5LTExVDExOjE1OjIyLjM1OTAwMFoiLCJDVkUtMjAyNi04OTI0MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.