# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Stored Cross-Site Scripting in StockAgile by Novadigits technologies](https://agentprime.io/advisories/CVE-2026-6087.md)
  `CVE-2026-6087` · CVE record: Novadigits technologies StockAgile · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting in StockAgile by Novadigits technologies](https://agentprime.io/advisories/CVE-2026-6086.md)
  `CVE-2026-6086` · CVE record: Novadigits technologies StockAgile · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting in StockAgile by Novadigits technologies](https://agentprime.io/advisories/CVE-2026-6085.md)
  `CVE-2026-6085` · CVE record: Novadigits technologies StockAgile · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting in StockAgile by Novadigits technologies](https://agentprime.io/advisories/CVE-2026-6084.md)
  `CVE-2026-6084` · CVE record: Novadigits technologies StockAgile · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting in StockAgile by Novadigits technologies](https://agentprime.io/advisories/CVE-2026-6083.md)
  `CVE-2026-6083` · CVE record: Novadigits technologies StockAgile · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting in StockAgile by Novadigits technologies](https://agentprime.io/advisories/CVE-2026-6082.md)
  `CVE-2026-6082` · CVE record: Novadigits technologies StockAgile · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css\[fonts\]' Parameter](https://agentprime.io/advisories/CVE-2026-95864.md)
  `CVE-2026-95864` · CVE record: themifyme Themify Builder · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value](https://agentprime.io/advisories/CVE-2026-94573.md)
  `CVE-2026-94573` · CVE record: addonsorg Repeater Fields for Elementor Forms · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements\[\].title' Parameter](https://agentprime.io/advisories/CVE-2026-84280.md)
  `CVE-2026-84280` · CVE record: radykal Fancy Product Designer · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter](https://agentprime.io/advisories/CVE-2026-13179.md)
  `CVE-2026-13179` · CVE record: flippercode WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings · CVSS 6.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field](https://agentprime.io/advisories/CVE-2026-95866.md)
  `CVE-2026-95866` · CVE record: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter](https://agentprime.io/advisories/CVE-2026-96568.md)
  `CVE-2026-96568` · CVE record: jetmonsters Restaurant Menu and Food Ordering · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field](https://agentprime.io/advisories/CVE-2026-93656.md)
  `CVE-2026-93656` · CVE record: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 6.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items\[\]\[product_name\]' Parameter](https://agentprime.io/advisories/CVE-2026-93654.md)
  `CVE-2026-93654` · CVE record: codename065 Premium Packages – Sell Digital Products Securely · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter](https://agentprime.io/advisories/CVE-2026-17577.md)
  `CVE-2026-17577` · CVE record: sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects · CVSS 6.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field](https://agentprime.io/advisories/CVE-2026-93747.md)
  `CVE-2026-93747` · CVE record: tomdever wpForo Forum · CVSS 6.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter](https://agentprime.io/advisories/CVE-2026-88996.md)
  `CVE-2026-88996` · CVE record: smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More · CVSS 6.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration](https://agentprime.io/advisories/CVE-2026-96752.md)
  `CVE-2026-96752` · CVE record: bmarshall511 Zero Spam for WordPress · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name](https://agentprime.io/advisories/CVE-2026-94376.md)
  `CVE-2026-94376` · CVE record: wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots · CVSS 6.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Gutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute](https://agentprime.io/advisories/CVE-2026-92746.md)
  `CVE-2026-92746` · CVE record: jegstudio Gutenverse – WordPress Blocks, Page Builder & Site Editor · CVSS 6.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter](https://agentprime.io/advisories/CVE-2026-96039.md)
  `CVE-2026-96039` · CVE record: bookingalgorithms BA Book Everything · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume](https://agentprime.io/advisories/CVE-2026-93303.md)
  `CVE-2026-93303` · CVE record: htplugins HT Contact Form – Drag & Drop Form Builder for WordPress · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter](https://agentprime.io/advisories/CVE-2026-96766.md)
  `CVE-2026-96766` · CVE record: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · CVSS 6.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job](https://agentprime.io/advisories/CVE-2026-84279.md)
  `CVE-2026-84279` · CVE record: radykal Fancy Product Designer · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '\_fpd_data' Order Item Meta](https://agentprime.io/advisories/CVE-2026-84281.md)
  `CVE-2026-84281` · CVE record: radykal Fancy Product Designer · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation](https://agentprime.io/advisories/CVE-2026-83591.md)
  `CVE-2026-83591` · CVE record: mohammed_kaludi AMP for WP – Accelerated Mobile Pages · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field](https://agentprime.io/advisories/CVE-2026-92212.md)
  `CVE-2026-92212` · CVE record: jetmonsters JetFormBuilder — Dynamic Blocks Form Builder · CVSS 6.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')](https://agentprime.io/advisories/CVE-2026-93897.md)
  `CVE-2026-93897` · CVE record: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · CVSS 6.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links](https://agentprime.io/advisories/CVE-2026-78393.md)
  `CVE-2026-78393` · CVE record: Unknown Link Library · CVSS 6.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in ITFlow](https://agentprime.io/advisories/CVE-2026-97735.md)
  `CVE-2026-97735` · CVE record: ITFlow ITFlow · CVSS 8.0 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode](https://agentprime.io/advisories/CVE-2025-14814.md)
  `CVE-2025-14814` · CVE record: wipeoutmedia CSS & JavaScript Toolbox · CVSS 6.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [ningzichun student-management-system addLog.php echo cross site scripting](https://agentprime.io/advisories/CVE-2026-97650.md)
  `CVE-2026-97650` · CVE record: ningzichun student-management-system · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Cross-site scripting in madpsy ka9q_ubersdr](https://agentprime.io/advisories/CVE-2026-97723.md)
  `CVE-2026-97723` · CVE record: madpsy ka9q_ubersdr · CVSS 5.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute…](https://agentprime.io/advisories/CVE-2026-88420.md)
  `CVE-2026-88420` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package](https://agentprime.io/advisories/CVE-2026-78902.md)
  `CVE-2026-78902` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS](https://agentprime.io/advisories/GHSA-j8r4-32c5-33rc.md)
  `GHSA-j8r4-32c5-33rc`, `CVE-2026-61784` · npm `xhtml-purifier`: affected `<0.4.3`, fixed in `0.4.3` · CVSS 6.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description](https://agentprime.io/advisories/CVE-2026-48543.md)
  `CVE-2026-48543` · CVE record: krayin laravel-crm · CVSS 5.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field](https://agentprime.io/advisories/CVE-2026-48542.md)
  `CVE-2026-48542` · CVE record: krayin laravel-crm · CVSS 5.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field](https://agentprime.io/advisories/CVE-2026-48541.md)
  `CVE-2026-48541` · CVE record: krayin laravel-crm · CVSS 5.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission](https://agentprime.io/advisories/GHSA-pgwp-vc7q-cvj3.md)
  `GHSA-pgwp-vc7q-cvj3`, `CVE-2026-56736`, `PKSA-rrfb-2zp9-ws1j`, `PKSA-xsdh-jbbj-vv28` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `<4.2.0-alpha`, fixed in `4.2.0-alpha` · CVSS 8.2 High · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title](https://agentprime.io/advisories/CVE-2026-48540.md)
  `CVE-2026-48540` · CVE record: krayin laravel-crm · CVSS 5.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [CyberChef: Prototype pollution in Series Chart operation](https://agentprime.io/advisories/GHSA-fx6f-382r-j72c.md)
  `GHSA-fx6f-382r-j72c`, `CVE-2026-57439` · npm `cyberchef`: affected `<11.2.0`, fixed in `11.2.0` · CVSS 5.0 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS), Prototype pollution
- [YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting](https://agentprime.io/advisories/CVE-2026-97322.md)
  `CVE-2026-97322` · CVE record: YunaiV ruoyi-vue-pro and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API](https://agentprime.io/advisories/GHSA-396x-xmvh-p563.md)
  `GHSA-396x-xmvh-p563`, `CVE-2026-63498`, `PKSA-yjnz-vzp8-t7f6` · Packagist `snipe/snipe-it`: affected `<8.7.0`, fixed in `8.7.0` · CVSS 8.7 High · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Snipe-IT: Stored XSS via Custom Field name in asset-list column headers](https://agentprime.io/advisories/GHSA-p9h3-gvpq-5539.md)
  `GHSA-p9h3-gvpq-5539`, `CVE-2026-62368`, `PKSA-t5db-tq3m-tn97` · Packagist `snipe/snipe-it`: affected `<8.7.0`, fixed in `8.7.0` · CVSS 8.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)](https://agentprime.io/advisories/CVE-2026-93405.md)
  `CVE-2026-93405` · CVE record: Foundry376 Mailspring · CVSS 6.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [volotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting](https://agentprime.io/advisories/CVE-2026-97233.md)
  `CVE-2026-97233` · CVE record: volotat Anagnorisis · CVSS 5.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Discourse: Encode action_code_who in mention URLs](https://agentprime.io/advisories/CVE-2026-91119.md)
  `CVE-2026-91119` · CVE record: discourse discourse · CVSS 6.4 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Discourse: Chat upload filenames rendered as raw HTML in excerpts](https://agentprime.io/advisories/CVE-2026-91121.md)
  `CVE-2026-91121` · CVE record: discourse discourse · CVSS 5.0 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Discourse: Stored HTML injection in video notification emails](https://agentprime.io/advisories/CVE-2026-91120.md)
  `CVE-2026-91120` · CVE record: discourse discourse · CVSS 5.4 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users](https://agentprime.io/advisories/CVE-2026-91122.md)
  `CVE-2026-91122` · CVE record: discourse discourse · CVSS 8.7 High · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Reflected XSS in CirrusSearch debug explain output](https://agentprime.io/advisories/CVE-2026-96873.md)
  `CVE-2026-96873` · CVE record: The Wikimedia Foundation Mediawiki - CirrusSearch Extension · CVSS 5.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SunEditor: Critical XSS vulnerability - sanitizer bypass](https://agentprime.io/advisories/GHSA-6rf4-v2fh-m6p4.md)
  `GHSA-6rf4-v2fh-m6p4`, `CVE-2026-59167` · npm `suneditor`: affected `<2.47.11`, fixed in `2.47.11` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Excalidraw Imported File restore.ts cross site scripting](https://agentprime.io/advisories/CVE-2026-97224.md)
  `CVE-2026-97224` · CVE record: Excalidraw · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application](https://agentprime.io/advisories/CVE-2026-12559.md)
  `CVE-2026-12559` · CVE record: OpenText Vendor Invoice Management for SAP Solutions · CVSS 7.3 High · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Aureus ERP 1.6.0 Stored XSS via SVG File Upload](https://agentprime.io/advisories/CVE-2026-97062.md)
  `CVE-2026-97062` · CVE record: Webkul Aureus ERP · CVSS 5.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor](https://agentprime.io/advisories/CVE-2026-4637.md)
  `CVE-2026-4637` · CVE record: Paessler GmbH PRTG Network Monitor · CVSS 5.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content](https://agentprime.io/advisories/CVE-2026-15731.md)
  `CVE-2026-15731` · CVE record: magazine3 WP Multilang – Translation and Multilingual Plugin · CVSS 6.4 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [PaperCut Hive Embedded App for Ricoh: Javascript injection](https://agentprime.io/advisories/CVE-2026-11744.md)
  `CVE-2026-11744` · CVE record: PaperCut PaperCut Hive · CVSS 3.8 Low · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category](https://agentprime.io/advisories/CVE-2026-89005.md)
  `CVE-2026-89005` · CVE record: Unknown WPeMatico RSS Feed Fetcher · CVSS 6.8 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTA5LTI0VDA2OjAwOjE5LjM3OTAwMFoiLCJDVkUtMjAyNi04OTAwNSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTA5LTI1VDA4OjMzOjA2LjM5MzAwMFoiLCJDVkUtMjAyNi02MDg4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTA5LTI1VDA4OjMzOjA2LjM5MzAwMFoiLCJDVkUtMjAyNi02MDg4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.