# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview](https://agentprime.io/advisories/CVE-2026-89002.md) `CVE-2026-89002` · CVE record: Unknown WPeMatico RSS Feed Fetcher · CVSS 6.8 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS) - [The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening](https://agentprime.io/advisories/CVE-2026-84151.md) `CVE-2026-84151` · CVE record: Unknown The Post Grid · CVSS 3.5 Low · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS) - [huanzi-qch base-admin Add User CommonController.java save cross site scripting](https://agentprime.io/advisories/CVE-2026-96810.md) `CVE-2026-96810` · CVE record: huanzi-qch base-admin · CVSS 5.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [SEMCMS KindEditor Upload upload_json.php cross site scripting](https://agentprime.io/advisories/CVE-2026-96739.md) `CVE-2026-96739` · CVE record: SEMCMS · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget](https://agentprime.io/advisories/GHSA-gvf2-2rh5-mpgf.md) `GHSA-gvf2-2rh5-mpgf`, `CVE-2026-77394` · npm `@openc3/vue-common`: affected `>=5.0.6, <7.3.0`, fixed in `7.3.0` · CVSS 7.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI](https://agentprime.io/advisories/CVE-2026-66077.md) `CVE-2026-66077` · CVE record: rabbitmq rabbitmq-server · CVSS 7.3 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling…](https://agentprime.io/advisories/CVE-2026-84683.md) `CVE-2026-84683` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-95586.md) `CVE-2026-95586` · CVE record: Themefic Ultimate Addons for Contact Form 7 · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-95530.md) `CVE-2026-95530` · CVE record: PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-95529.md) `CVE-2026-95529` · CVE record: codepeople Calculated Fields Form · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-95528.md) `CVE-2026-95528` · CVE record: Mohammed Kaludi Core Web Vitals & PageSpeed Booster · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-95515.md) `CVE-2026-95515` · CVE record: Kevin Stover Ninja Forms · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94682.md) `CVE-2026-94682` · CVE record: SecondLineThemes Podcast Importer SecondLine · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94680.md) `CVE-2026-94680` · CVE record: RadiusTheme The Post Grid · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94671.md) `CVE-2026-94671` · CVE record: RadiusTheme The Post Grid · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94500.md) `CVE-2026-94500` · CVE record: Roxnor ElementsKit Elementor addons Lite · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94461.md) `CVE-2026-94461` · CVE record: metaphorcreations Ditty · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94391.md) `CVE-2026-94391` · CVE record: Rustaurius Ultimate FAQ · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94179.md) `CVE-2026-94179` · CVE record: Razorpay Razorpay Payment Button · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94176.md) `CVE-2026-94176` · CVE record: Kitae Park Mang Board WP · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94168.md) `CVE-2026-94168` · CVE record: Leap13 Premium Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94118.md) `CVE-2026-94118` · CVE record: Leap13 Premium Blocks – Gutenberg Blocks for WordPress · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-93774.md) `CVE-2026-93774` · CVE record: Jacob N. Breetvelt WP Photo Album Plus · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-93772.md) `CVE-2026-93772` · CVE record: Tomdever wpForo Forum · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-93622.md) `CVE-2026-93622` · CVE record: NicolasKulka WPS Limit Login · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-93618.md) `CVE-2026-93618` · CVE record: Crocoblock. Jetimpex Inc. JetTricks · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-93526.md) `CVE-2026-93526` · CVE record: Nexcess Event Tickets · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name](https://agentprime.io/advisories/CVE-2026-92730.md) `CVE-2026-92730` · CVE record: LimeSurvey LimeSurvey · CVSS 7.4 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings](https://agentprime.io/advisories/CVE-2026-91775.md) `CVE-2026-91775` · CVE record: LimeSurvey LimeSurvey · CVSS 7.4 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover](https://agentprime.io/advisories/CVE-2026-93769.md) `CVE-2026-93769` · CVE record: Humhub Humhub · CVSS 7.2 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18872.md) `CVE-2026-18872` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames](https://agentprime.io/advisories/GHSA-w998-qmw9-mf4m.md) `GHSA-w998-qmw9-mf4m`, `CVE-2026-63002`, `PKSA-hw96-c37g-vqkw` · Packagist `redaxo/source`: affected `<5.21.2`, fixed in `5.21.2` · CVSS 4.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [REDAXO: Stored XSS via Unescaped Media Manager Type Name in \`mediaIsInUse()\`](https://agentprime.io/advisories/GHSA-mf2p-wjp4-99pq.md) `GHSA-mf2p-wjp4-99pq`, `CVE-2026-63001`, `PKSA-hspm-hyxh-6wd5` · Packagist `redaxo/source`: affected `<5.21.2`, fixed in `5.21.2` · CVSS 4.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Multiple vulnerabilities in the Microweber administration panel](https://agentprime.io/advisories/CVE-2026-5696.md) `CVE-2026-5696` · CVE record: Microweber Administration panel · CVSS 5.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms](https://agentprime.io/advisories/CVE-2026-91928.md) `CVE-2026-91928` · CVE record: Apache Software Foundation Apache Sling XSS · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains](https://agentprime.io/advisories/CVE-2026-95626.md) `CVE-2026-95626` · CVE record: Tauri tauri · CVSS 8.3 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl](https://agentprime.io/advisories/CVE-2026-91852.md) `CVE-2026-91852` · CVE record: Apache Software Foundation Apache Sling XSS · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Sling XSS: Improper escaping in the XSS Webconsole plugin](https://agentprime.io/advisories/CVE-2026-91999.md) `CVE-2026-91999` · CVE record: Apache Software Foundation Apache Sling XSS · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Sling XSS: XSS possible through XSSAPI.getValidHref()](https://agentprime.io/advisories/CVE-2026-73192.md) `CVE-2026-73192` · CVE record: Apache Software Foundation Apache Sling XSS · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'](https://agentprime.io/advisories/CVE-2026-5924.md) `CVE-2026-5924` · CVE record: jetmonsters Getwid – Gutenberg Blocks · CVSS 6.4 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting](https://agentprime.io/advisories/CVE-2026-91073.md) `CVE-2026-91073` · CVE record: Unknown Subscribe Forms · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key](https://agentprime.io/advisories/CVE-2026-88997.md) `CVE-2026-88997` · CVE record: Unknown JSM Show Post Metadata · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget](https://agentprime.io/advisories/CVE-2026-85006.md) `CVE-2026-85006` · CVE record: Unknown HappyAddons for Elementor · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Real3D Flipbook Lite < 5.4 - Author+ Stored XSS](https://agentprime.io/advisories/CVE-2025-15696.md) `CVE-2025-15696` · CVE record: Unknown Real3D Flipbook · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting](https://agentprime.io/advisories/CVE-2026-96258.md) `CVE-2026-96258` · CVE record: onSite internet GmbH Auktion NG Auktionssoftware · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scripting](https://agentprime.io/advisories/CVE-2026-95957.md) `CVE-2026-95957` · CVE record: SourceCodester Smart Attendance System with QR Code Scanner · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18131.md) `CVE-2026-18131` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 8.2 High · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline](https://agentprime.io/advisories/CVE-2026-77912.md) `CVE-2026-77912` · CVE record: GitHub Enterprise Server · CVSS 7.4 High · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [Home Assistant: XSS in Statistics Graph Card](https://agentprime.io/advisories/GHSA-wx4m-69m9-gx3m.md) `GHSA-wx4m-69m9-gx3m`, `CVE-2026-91130`, `PYSEC-2026-4052` · PyPI `homeassistant`: affected `<2026.7.0`, fixed in `2026.7.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content](https://agentprime.io/advisories/GHSA-xpjq-3w4w-w5wr.md) `GHSA-xpjq-3w4w-w5wr`, `CVE-2026-86062`, `PYSEC-2026-4065` · PyPI `lightrag-hku`: affected `<1.5.5`, fixed in `1.5.5` · CVSS 6.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3](https://agentprime.io/advisories/CVE-2026-88020.md) `CVE-2026-88020` · CVE record: Autonomy Logic OpenPLC Runtime · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text](https://agentprime.io/advisories/GHSA-56v6-2fhr-wxgq.md) `GHSA-56v6-2fhr-wxgq`, `CVE-2026-83801`, `PYSEC-2026-4110` · PyPI `nautobot`: affected `<2.4.37 || >=3.0.0, <3.1.8`, fixed in `2.4.37`, `3.1.8` · CVSS 5.4 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler](https://agentprime.io/advisories/GHSA-g2r2-3j32-j27x.md) `GHSA-g2r2-3j32-j27x`, `CVE-2026-77272`, `PYSEC-2026-4093` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 5.4 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [Unleash: CR-approval email renders user-controlled raw HTML](https://agentprime.io/advisories/GHSA-7hvx-28gp-mf6j.md) `GHSA-7hvx-28gp-mf6j`, `CVE-2026-76909` · npm `unleash-server`: affected `<8.0.3`, fixed in `8.0.3` · CVSS 2.1 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme](https://agentprime.io/advisories/GHSA-8gr3-5j6f-25gp.md) `GHSA-8gr3-5j6f-25gp`, `CVE-2026-75510` · npm `@novu/js`: affected `<3.18.0`, fixed in `3.18.0` · CVSS 5.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters](https://agentprime.io/advisories/CVE-2026-95812.md) `CVE-2026-95812` · CVE record: MacWarrior clipbucket-v5 · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75744.md) `CVE-2026-75744` · CVE record: Adobe AEM 6.5 Forms JEE and 1 more · CVSS 8.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75689.md) `CVE-2026-75689` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-48361.md) `CVE-2026-48361` · CVE record: Adobe Adobe Connect and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) - [Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75698.md) `CVE-2026-75698` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .