# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Toptech TMS7 and TopHAT Cross-site Scripting](https://agentprime.io/advisories/CVE-2026-71189.md) `CVE-2026-71189` · CVE record: Toptech Systems TMS7 and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Lantronix G520 Series Cellular Gateway Cross-site Scripting](https://agentprime.io/advisories/CVE-2026-84409.md) `CVE-2026-84409` · CVE record: Lantronix G520 Series · CVSS 7.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Google Chrome](https://agentprime.io/advisories/CVE-2026-102329.md) `CVE-2026-102329` · CVE record: Google Chrome · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Laravel: XSS in Debug Page Information](https://agentprime.io/advisories/GHSA-jh5r-qr3c-85q8.md) `GHSA-jh5r-qr3c-85q8`, `CVE-2026-102279`, `PKSA-d5tc-s1qs-h781` · Packagist `laravel/framework`: affected `<12.69.0 || >=13.0.0, <13.30.0`, fixed in `12.69.0`, `13.30.0` · CVSS 3.1 Low · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation](https://agentprime.io/advisories/GHSA-hj66-6f7g-4r5v.md) `GHSA-hj66-6f7g-4r5v`, `CVE-2026-49264`, `PYSEC-2026-4113` · PyPI `oauthlib`: affected `>=0.6.1, <4.0.0`, fixed in `4.0.0` · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4](https://agentprime.io/advisories/CVE-2026-101127.md) `CVE-2026-101127` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS on Wikibase Special:SetSiteLink via unescaped system message](https://agentprime.io/advisories/CVE-2026-100245.md) `CVE-2026-100245` · CVE record: Wikimedia Foundation Mediawiki - Wikibase Extension · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla! Core - \[20260911\] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92224.md) `CVE-2026-92224` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS in WikiSEO author and image properties on action=info](https://agentprime.io/advisories/CVE-2026-100243.md) `CVE-2026-100243` · CVE record: Wikimedia Foundation Mediawiki - WikiSEO Extension · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla! Core - \[20260904\] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90914.md) `CVE-2026-90914` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla! Core - \[20260915\] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92231.md) `CVE-2026-92231` · CVE record: Joomla! Project Joomla! CMS and 1 more · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla! Core - \[20260908\] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90918.md) `CVE-2026-90918` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla! Core - \[20260912\] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92225.md) `CVE-2026-92225` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla! Core - \[20260916\] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92232.md) `CVE-2026-92232` · CVE record: Joomla! Project Joomla! CMS and 1 more · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla! Core - \[20260901\] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90906.md) `CVE-2026-90906` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS](https://agentprime.io/advisories/CVE-2026-100238.md) `CVE-2026-100238` · CVE record: Wikimedia Foundation Mediawiki - Flow Extension · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Webmin: Reflected XSS in the Configuration module](https://agentprime.io/advisories/CVE-2026-49243.md) `CVE-2026-49243` · CVE record: webmin webmin · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [HTML injection](https://agentprime.io/advisories/CVE-2026-101270.md) `CVE-2026-101270` · CVE record: pretix pretix · CVSS 2.1 Low · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [HPE OneView - Cross-site scripting vulnerability](https://agentprime.io/advisories/CVE-2026-76719.md) `CVE-2026-76719` · CVE record: Hewlett Packard Enterprise HPE OneView · CVSS 8.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [HPE OneView - Cross-site scripting vulnerability](https://agentprime.io/advisories/CVE-2026-76718.md) `CVE-2026-76718` · CVE record: Hewlett Packard Enterprise HPE OneView · CVSS 8.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2026-84739.md) `CVE-2026-84739` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [coolbeans1212 MateisHomePage-Website users.php cross site scripting](https://agentprime.io/advisories/CVE-2026-102292.md) `CVE-2026-102292` · CVE record: coolbeans1212 MateisHomePage-Website · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting](https://agentprime.io/advisories/CVE-2026-102290.md) `CVE-2026-102290` · CVE record: CodeCanyon Rocket LMS · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting](https://agentprime.io/advisories/CVE-2026-102264.md) `CVE-2026-102264` · CVE record: mwasikz robo-cafe-rms · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field](https://agentprime.io/advisories/CVE-2026-96326.md) `CVE-2026-96326` · CVE record: htplugins HT Contact Form – Drag & Drop Form Builder for WordPress · CVSS 7.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector](https://agentprime.io/advisories/CVE-2026-102374.md) `CVE-2026-102374` · CVE record: GestSup GestSup · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector](https://agentprime.io/advisories/CVE-2026-102372.md) `CVE-2026-102372` · CVE record: GestSup GestSup · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username par…](https://agentprime.io/advisories/CVE-2024-31027.md) `CVE-2024-31027` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS) - [httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL](https://agentprime.io/advisories/CVE-2026-102333.md) `CVE-2026-102333` · CVE record: cle-b httpdbg · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Angular SSR: XSS via Unescaped Processing Instruction (\) Nodes in Fallback Raw-Content Elements](https://agentprime.io/advisories/GHSA-j3r3-mxqp-r2p4.md) `GHSA-j3r3-mxqp-r2p4`, `CVE-2026-88058` · npm `@angular/platform-server`: affected `<=19.2.25 || >=20.0.0, <20.3.30 || >=21.0.0, <21.2.22 || >=22.0.0, <22.1.4`, fixed in `20.3.30`, `21.2.22`, `22.1.4` · CVSS 8.6 High · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [Eleveo Call Recording Software Play Audio audio.jsp cross site scripting](https://agentprime.io/advisories/CVE-2026-101141.md) `CVE-2026-101141` · CVE record: Eleveo Call Recording Software · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6](https://agentprime.io/advisories/CVE-2026-101111.md) `CVE-2026-101111` · CVE record: ordasoft.com Book Library (Free) extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8](https://agentprime.io/advisories/CVE-2026-101109.md) `CVE-2026-101109` · CVE record: ordasoft.com Vehicle Manager (Free) extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9](https://agentprime.io/advisories/CVE-2026-100753.md) `CVE-2026-100753` · CVE record: ordasoft.com Real Estate Manager (Free) extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher](https://agentprime.io/advisories/CVE-2026-88804.md) `CVE-2026-88804` · CVE record: SUSE Rancher · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Multiple Reflected XSS in Dayforce ESS Excelity](https://agentprime.io/advisories/CVE-2026-73641.md) `CVE-2026-73641` · CVE record: Dayforce ESS Excelity · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [HTML Injection in Enocta Educational's Enocta Platform](https://agentprime.io/advisories/CVE-2026-82326.md) `CVE-2026-82326` · CVE record: Enocta Educational Technologies Inc. Enocta Platform · CVSS 4.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [HTML Injection in Rolantis Information Technologies' Agentis](https://agentprime.io/advisories/CVE-2026-87752.md) `CVE-2026-87752` · CVE record: Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis · CVSS 6.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting (XSS) in TPVEnlanube](https://agentprime.io/advisories/CVE-2026-7171.md) `CVE-2026-7171` · CVE record: TPVEnlanube Cloud Web application · CVSS 4.8 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting (XSS) in TPVEnlanube](https://agentprime.io/advisories/CVE-2026-7172.md) `CVE-2026-7172` · CVE record: TPVEnlanube Cloud Web application · CVSS 4.8 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting (XSS) in TPVEnlanube](https://agentprime.io/advisories/CVE-2026-7170.md) `CVE-2026-7170` · CVE record: TPVEnlanube Cloud Web application · CVSS 4.8 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Roller: Stored XSS in comment moderation via comment author URL](https://agentprime.io/advisories/CVE-2026-86507.md) `CVE-2026-86507` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS in BİMSER's eBA Plus](https://agentprime.io/advisories/CVE-2026-82969.md) `CVE-2026-82969` · CVE record: Bimser Solution Software Trade Inc. eBA Plus Document and Workflow Management System · CVSS 5.4 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Roller: Stored cross-site scripting in the authoring UI](https://agentprime.io/advisories/CVE-2026-82381.md) `CVE-2026-82381` · CVE record: Apache Software Foundation Apache Roller · CVSS 5.4 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Roller: Reflected cross-site scripting in the frontpage directory parameter](https://agentprime.io/advisories/CVE-2026-82382.md) `CVE-2026-82382` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Roller: Stored cross-site scripting via uploaded media content type](https://agentprime.io/advisories/CVE-2026-82387.md) `CVE-2026-82387` · CVE record: Apache Software Foundation Apache Roller · CVSS 5.4 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Roller: Stored cross-site scripting through incoming Trackback links](https://agentprime.io/advisories/CVE-2026-82546.md) `CVE-2026-82546` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Roller: Stored javascript: URI in HTML comments](https://agentprime.io/advisories/CVE-2026-91204.md) `CVE-2026-91204` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Apache Roller: Reflected XSS in the optional LDAP comment authenticator](https://agentprime.io/advisories/CVE-2026-91206.md) `CVE-2026-91206` · CVE record: Apache Software Foundation Apache Roller · CVSS 6.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0](https://agentprime.io/advisories/CVE-2026-100751.md) `CVE-2026-100751` · CVE record: regularlabs.com Tabs & Accordions (Free, Pro) extension for Joomla · CVSS 7.5 High · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS) - [amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting](https://agentprime.io/advisories/CVE-2026-100904.md) `CVE-2026-100904` · CVE record: amirsanni mini-inventory-and-sales-management-system · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting](https://agentprime.io/advisories/CVE-2026-100882.md) `CVE-2026-100882` · CVE record: Krayin laravel-crm · CVSS 4.8 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [zhistaredu StarTraining application.yml cross site scripting](https://agentprime.io/advisories/CVE-2026-100881.md) `CVE-2026-100881` · CVE record: zhistaredu StarTraining · CVSS 2.1 Low · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting](https://agentprime.io/advisories/CVE-2026-100880.md) `CVE-2026-100880` · CVE record: zhistaredu StarTraining · CVSS 5.1 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting](https://agentprime.io/advisories/CVE-2026-100877.md) `CVE-2026-100877` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0](https://agentprime.io/advisories/CVE-2026-97165.md) `CVE-2026-97165` · CVE record: svenbluege.de Event Gallery for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site scripting (XSS), Open redirect - [PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block](https://agentprime.io/advisories/CVE-2026-97319.md) `CVE-2026-97319` · CVE record: Unknown PowerPress Podcasting plugin by Blubrry · CVSS 6.8 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site scripting (XSS) - [Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script](https://agentprime.io/advisories/CVE-2026-96899.md) `CVE-2026-96899` · CVE record: Unknown Optima Express IDX · CVSS 6.8 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site scripting (XSS) - [WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes](https://agentprime.io/advisories/CVE-2026-96895.md) `CVE-2026-96895` · CVE record: Unknown WP YouTube Lyte · CVSS 6.8 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site scripting (XSS) - [WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import](https://agentprime.io/advisories/CVE-2026-89006.md) `CVE-2026-89006` · CVE record: Unknown WPeMatico RSS Feed Fetcher · CVSS 6.8 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .