# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription](https://agentprime.io/advisories/CVE-2026-86609.md)
  `CVE-2026-86609` · CVE record: Unknown Download Manager · CVSS 8.8 High · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site scripting (XSS)
- [EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes](https://agentprime.io/advisories/CVE-2026-85002.md)
  `CVE-2026-85002` · CVE record: Unknown EmbedPress · CVSS 6.8 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Froxlor before 2.3.12 Stored XSS via SSL certificate issuer](https://agentprime.io/advisories/CVE-2026-100720.md)
  `CVE-2026-100720` · CVE record: froxlor froxlor · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE](https://agentprime.io/advisories/CVE-2026-100695.md)
  `CVE-2026-100695` · CVE record: vrana adminer · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Hugo before 0.166.0 Cross-Site Scripting via text/org](https://agentprime.io/advisories/CVE-2026-100694.md)
  `CVE-2026-100694` · CVE record: gohugoio hugo · CVSS 5.1 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Hugo before 0.166.0 Stored XSS via lineAnchors code block option](https://agentprime.io/advisories/CVE-2026-100691.md)
  `CVE-2026-100691` · CVE record: gohugoio hugo · CVSS 5.1 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Grav Data Manager before 1.4.5 Stored XSS via item-detail view](https://agentprime.io/advisories/CVE-2026-100673.md)
  `CVE-2026-100673` · CVE record: getgrav grav-plugin-datamanager · CVSS 8.4 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban](https://agentprime.io/advisories/CVE-2026-100645.md)
  `CVE-2026-100645` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SiYuan before v3.8.4 Stored XSS via Attribute View textarea](https://agentprime.io/advisories/CVE-2026-100643.md)
  `CVE-2026-100643` · CVE record: siyuan-note siyuan · CVSS 8.5 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content](https://agentprime.io/advisories/CVE-2026-100641.md)
  `CVE-2026-100641` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL](https://agentprime.io/advisories/CVE-2026-100639.md)
  `CVE-2026-100639` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field](https://agentprime.io/advisories/CVE-2026-100630.md)
  `CVE-2026-100630` · CVE record: WWBN AVideo · CVSS 5.1 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting](https://agentprime.io/advisories/CVE-2026-100313.md)
  `CVE-2026-100313` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting](https://agentprime.io/advisories/CVE-2026-100311.md)
  `CVE-2026-100311` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.1 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block](https://agentprime.io/advisories/CVE-2026-96531.md)
  `CVE-2026-96531` · CVE record: Unknown Optimole · CVSS 6.8 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name](https://agentprime.io/advisories/CVE-2026-92411.md)
  `CVE-2026-92411` · CVE record: Unknown WP Delicious · CVSS 6.8 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass](https://agentprime.io/advisories/CVE-2026-85081.md)
  `CVE-2026-85081` · CVE record: Unknown File Manager and 2 more · CVSS 7.5 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields](https://agentprime.io/advisories/CVE-2026-84096.md)
  `CVE-2026-84096` · CVE record: Unknown wp-review-slider-pro · CVSS 8.0 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import](https://agentprime.io/advisories/CVE-2026-84095.md)
  `CVE-2026-84095` · CVE record: Unknown wp-review-slider-pro · CVSS 8.0 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields](https://agentprime.io/advisories/CVE-2026-16591.md)
  `CVE-2026-16591` · CVE record: Unknown WP Directory Kit · CVSS 7.2 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI](https://agentprime.io/advisories/CVE-2026-15273.md)
  `CVE-2026-15273` · CVE record: Automatic.css Automatic.css · CVSS 6.4 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cotonti through 1.0.0 Reflected XSS via message.php lng parameter](https://agentprime.io/advisories/CVE-2026-100522.md)
  `CVE-2026-100522` · CVE record: Cotonti Cotonti · CVSS 5.1 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cotonti through 1.0.0 Reflected XSS via search highlight parameter](https://agentprime.io/advisories/CVE-2026-100521.md)
  `CVE-2026-100521` · CVE record: Cotonti Cotonti · CVSS 5.1 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View](https://agentprime.io/advisories/CVE-2026-71483.md)
  `CVE-2026-71483` · CVE record: horilla horilla-hr · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored i18n XSS in WikiLambda's VisualEditor integration](https://agentprime.io/advisories/CVE-2026-100383.md)
  `CVE-2026-100383` · CVE record: Wikimedia Foundation Mediawiki - WikiLambda Extension · CVSS 4.8 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [UploadWizard Flickr collection and set titles allow DOM XSS](https://agentprime.io/advisories/CVE-2026-100381.md)
  `CVE-2026-100381` · CVE record: Wikimedia Foundation Mediawiki - UploadWizard Extension · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Reflected XSS in Wikibase Special:SetLabel language validation](https://agentprime.io/advisories/CVE-2026-100380.md)
  `CVE-2026-100380` · CVE record: Wikimedia Foundation Mediawiki - Wikibase Extension · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix](https://agentprime.io/advisories/CVE-2026-100376.md)
  `CVE-2026-100376` · CVE record: Wikimedia Foundation Mediawiki - TemplateSandbox Extension · CVSS 4.8 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cargo Exhibit field alias allows stored XSS](https://agentprime.io/advisories/CVE-2026-96878.md)
  `CVE-2026-96878` · CVE record: The Wikimedia Foundation Mediawiki - Cargo extension · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Reflected XSS through Cargo Drilldown full-text search](https://agentprime.io/advisories/CVE-2026-96877.md)
  `CVE-2026-96877` · CVE record: The Wikimedia Foundation Mediawiki - Cargo extension · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Anonymous reflected XSS in CargoExport invalid-alias errors](https://agentprime.io/advisories/CVE-2026-96876.md)
  `CVE-2026-96876` · CVE record: The Wikimedia Foundation Mediawiki - Cargo extension · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Reflected XSS in Cargo Drilldown hierarchy filters](https://agentprime.io/advisories/CVE-2026-96875.md)
  `CVE-2026-96875` · CVE record: The Wikimedia Foundation Mediawiki - Cargo extension · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting](https://agentprime.io/advisories/CVE-2026-97897.md)
  `CVE-2026-97897` · CVE record: Krayin laravel-crm · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [GLPI: Reflected XSS in dashboards](https://agentprime.io/advisories/CVE-2026-53610.md)
  `CVE-2026-53610` · CVE record: glpi-project glpi · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting](https://agentprime.io/advisories/CVE-2026-97896.md)
  `CVE-2026-97896` · CVE record: krayin laravel-crm · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute](https://agentprime.io/advisories/CVE-2026-84463.md)
  `CVE-2026-84463` · CVE record: zammad zammad · CVSS 6.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF), CWE-838
- [Zammad: Stored XSS via unescaped option labels in the object attribute options context UI](https://agentprime.io/advisories/CVE-2026-63216.md)
  `CVE-2026-63216` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Zammad: Cross-Site Scripting in Ticket Notifications](https://agentprime.io/advisories/CVE-2026-56731.md)
  `CVE-2026-56731` · CVE record: zammad zammad · CVSS 8.4 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored i18n XSS in the Flow integration of Thanks](https://agentprime.io/advisories/CVE-2026-100237.md)
  `CVE-2026-100237` · CVE record: The Wikimedia Foundation Mediawiki - Thanks Extension · CVSS 6.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [CVE-2026-18311](https://agentprime.io/advisories/CVE-2026-18311.md)
  `CVE-2026-18311` · CVE record: Readwise Reader · CVSS 6.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [CVE-2026-18320](https://agentprime.io/advisories/CVE-2026-18320.md)
  `CVE-2026-18320` · CVE record: Readwise Reader · CVSS 6.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [CVE-2026-18312](https://agentprime.io/advisories/CVE-2026-18312.md)
  `CVE-2026-18312` · CVE record: Readwise Reader · CVSS 6.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI](https://agentprime.io/advisories/CVE-2026-67239.md)
  `CVE-2026-67239` · CVE record: rabbitmq rabbitmq-server · CVSS 7.6 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint](https://agentprime.io/advisories/CVE-2026-67237.md)
  `CVE-2026-67237` · CVE record: rabbitmq rabbitmq-server · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms](https://agentprime.io/advisories/CVE-2026-85293.md)
  `CVE-2026-85293` · CVE record: InvoicePlane InvoicePlane · CVSS 4.8 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled](https://agentprime.io/advisories/GHSA-v65j-hff3-753c.md)
  `GHSA-v65j-hff3-753c`, `CVE-2026-57440`, `PKSA-1f7b-5f9b-ggt9` · Packagist `starcitizenwiki/embedvideo`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute](https://agentprime.io/advisories/GHSA-qxg3-46rw-79j8.md)
  `GHSA-qxg3-46rw-79j8`, `CVE-2026-61823`, `PKSA-735v-pwws-tf2j` · Packagist `code16/sharp`: affected `<9.22.5`, fixed in `9.22.5` · CVSS 7.3 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [code16/sharp has a stored XSS via data-html-content Sanitizer Bypass](https://agentprime.io/advisories/GHSA-vj3q-vp3g-j9c8.md)
  `GHSA-vj3q-vp3g-j9c8`, `CVE-2026-61825`, `PKSA-p6zx-3z97-z7f8` · Packagist `code16/sharp`: affected `<9.22.5`, fixed in `9.22.5` · CVSS 8.7 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [sheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting](https://agentprime.io/advisories/CVE-2026-97868.md)
  `CVE-2026-97868` · CVE record: sheshbabu zen · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Stored XSS in Cargo Drilldown tab names](https://agentprime.io/advisories/CVE-2026-96874.md)
  `CVE-2026-96874` · CVE record: The Wikimedia Foundation Mediawiki - Cargo extension · CVSS 2.3 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address](https://agentprime.io/advisories/CVE-2026-93647.md)
  `CVE-2026-93647` · CVE record: Zimbra Zimbra Collaboration Suite (ZCS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation](https://agentprime.io/advisories/CVE-2026-93642.md)
  `CVE-2026-93642` · CVE record: Zimbra Zimbra Collaboration Suite (ZCS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation](https://agentprime.io/advisories/CVE-2026-93641.md)
  `CVE-2026-93641` · CVE record: Zimbra Zimbra Collaboration Suite (ZCS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page](https://agentprime.io/advisories/CVE-2026-100190.md)
  `CVE-2026-100190` · CVE record: ail project ail framework · CVSS 6.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip](https://agentprime.io/advisories/CVE-2026-100176.md)
  `CVE-2026-100176` · CVE record: ail project ail framework · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names](https://agentprime.io/advisories/CVE-2026-100174.md)
  `CVE-2026-100174` · CVE record: ail project ail framework · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes](https://agentprime.io/advisories/CVE-2026-100172.md)
  `CVE-2026-100172` · CVE record: ail project ail framework · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT](https://agentprime.io/advisories/CVE-2026-27867.md)
  `CVE-2026-27867` · CVE record: Teldat Regesta Smart HD-PLC - TLDPH16D2 · CVSS 4.8 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS](https://agentprime.io/advisories/GHSA-8rqp-v692-v82q.md)
  `GHSA-8rqp-v692-v82q`, `CVE-2026-92106`, `EEF-CVE-2026-92106` · Hex `lazy_html`: affected `>=0.1.0, <0.1.13`, fixed in `0.1.13` · CVSS 2.3 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting in StockAgile by Novadigits technologies](https://agentprime.io/advisories/CVE-2026-6088.md)
  `CVE-2026-6088` · CVE record: Novadigits technologies StockAgile · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTA5LTI1VDA4OjMzOjA2LjM5MzAwMFoiLCJDVkUtMjAyNi02MDg4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTA5LTI3VDA2OjAwOjIxLjQ0NjAwMFoiLCJDVkUtMjAyNi04OTAwNiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTA5LTI3VDA2OjAwOjIxLjQ0NjAwMFoiLCJDVkUtMjAyNi04OTAwNiJd>. Everything for agents: <https://agentprime.io/llms.txt>.