# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload](https://agentprime.io/advisories/CVE-2026-84223.md) `CVE-2026-84223` · CVE record: Unknown Kirki · CVSS 6.8 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS) - [Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-14844.md) `CVE-2026-14844` · CVE record: Unknown Master Slider · CVSS 6.8 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS) - [olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting](https://agentprime.io/advisories/CVE-2026-93956.md) `CVE-2026-93956` · CVE record: olivier-ls PHP-FTS · CVSS 5.1 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS](https://agentprime.io/advisories/GHSA-6623-4q32-82v8.md) `GHSA-6623-4q32-82v8` · npm `hono`: affected `*`, no fixed version yet · CVSS 4.7 Medium · Withdrawn · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter](https://agentprime.io/advisories/CVE-2026-76579.md) `CVE-2026-76579` · CVE record: litespeedtech LiteSpeed Cache · CVSS 4.7 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input](https://agentprime.io/advisories/CVE-2026-1256.md) `CVE-2026-1256` · CVE record: ysinnovations YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers · CVSS 6.4 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Gum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting](https://agentprime.io/advisories/CVE-2026-8354.md) `CVE-2026-8354` · CVE record: celomitan Gum Addon for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input](https://agentprime.io/advisories/CVE-2026-5410.md) `CVE-2026-5410` · CVE record: davidanderson Redux Framework · CVSS 6.4 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-15098.md) `CVE-2026-15098` · CVE record: creativeinteractivemedia Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder · CVSS 6.4 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag](https://agentprime.io/advisories/CVE-2026-87917.md) `CVE-2026-87917` · CVE record: dvankooten MC4WP: Mailchimp for WordPress · CVSS 6.1 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input](https://agentprime.io/advisories/CVE-2026-5400.md) `CVE-2026-5400` · CVE record: davidanderson Redux Framework · CVSS 6.4 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting](https://agentprime.io/advisories/CVE-2026-12402.md) `CVE-2026-12402` · CVE record: xootix OTP Login & Register Woocommerce · CVSS 4.4 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode](https://agentprime.io/advisories/CVE-2026-2422.md) `CVE-2026-2422` · CVE record: ghozylab WP Composer – The Easiest Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters](https://agentprime.io/advisories/CVE-2026-15463.md) `CVE-2026-15463` · CVE record: sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects · CVSS 6.1 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler](https://agentprime.io/advisories/CVE-2026-13770.md) `CVE-2026-13770` · CVE record: appmysite AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) · CVSS 6.4 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value](https://agentprime.io/advisories/CVE-2026-15664.md) `CVE-2026-15664` · CVE record: mdmag Quill Forms | Conversational Multi Step Forms, Surveys & quizzes · CVSS 7.2 High · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter](https://agentprime.io/advisories/CVE-2026-11608.md) `CVE-2026-11608` · CVE record: bompus WP Customer Reviews · CVSS 6.1 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings](https://agentprime.io/advisories/CVE-2026-88824.md) `CVE-2026-88824` · CVE record: Unknown Master Blocks · CVSS 8.8 High · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title](https://agentprime.io/advisories/CVE-2026-85680.md) `CVE-2026-85680` · CVE record: Unknown Ultimate Member · CVSS 8.8 High · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter](https://agentprime.io/advisories/CVE-2026-76790.md) `CVE-2026-76790` · CVE record: Unknown Estatik Real Estate Plugin · CVSS 7.1 High · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting](https://agentprime.io/advisories/CVE-2025-15698.md) `CVE-2025-15698` · CVE record: Unknown Business Name Generator · CVSS 3.5 Low · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter](https://agentprime.io/advisories/CVE-2026-12042.md) `CVE-2026-12042` · CVE record: f1logic WP2Social Auto Publish · CVSS 4.4 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter](https://agentprime.io/advisories/CVE-2026-92967.md) `CVE-2026-92967` · CVE record: wppochipp Pochipp · CVSS 6.1 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters](https://agentprime.io/advisories/CVE-2026-89081.md) `CVE-2026-89081` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.1 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content](https://agentprime.io/advisories/CVE-2026-13354.md) `CVE-2026-13354` · CVE record: gabelivan Asset CleanUp: Page Speed Booster · CVSS 7.2 High · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-77820.md) `CVE-2026-77820` · CVE record: stellarwp WPComplete · CVSS 6.4 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS) - [SiYuan through 3.8.4 Stored XSS via Heading Style Attribute](https://agentprime.io/advisories/CVE-2026-93923.md) `CVE-2026-93923` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [SiYuan through 3.8.4 Stored XSS via notebook names](https://agentprime.io/advisories/CVE-2026-93922.md) `CVE-2026-93922` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)](https://agentprime.io/advisories/CVE-2026-85271.md) `CVE-2026-85271` · CVE record: openedx openedx-platform · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84108.md) `CVE-2026-84108` · CVE record: IBM Guardium Data Protection · CVSS 8.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84106.md) `CVE-2026-84106` · CVE record: IBM Guardium Data Protection · CVSS 8.9 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84074.md) `CVE-2026-84074` · CVE record: IBM Guardium Data Protection · CVSS 8.9 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84070.md) `CVE-2026-84070` · CVE record: IBM Guardium Data Protection · CVSS 8.9 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84031.md) `CVE-2026-84031` · CVE record: IBM Guardium Data Protection · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-82890.md) `CVE-2026-82890` · CVE record: IBM Guardium Data Protection · CVSS 5.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-82832.md) `CVE-2026-82832` · CVE record: IBM Guardium Data Protection · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus](https://agentprime.io/advisories/CVE-2026-93432.md) `CVE-2026-93432` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.4.redhat and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer](https://agentprime.io/advisories/GHSA-3753-m2x2-q623.md) `GHSA-3753-m2x2-q623`, `CVE-2026-91127` · npm `@file-viewer/doc` and 1 more: affected `<2.3.1`, fixed in `2.3.1` · CVSS 8.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [md-editor-v3: XSS via fenced-code language rendering bypass](https://agentprime.io/advisories/GHSA-3rm2-h79c-8qw6.md) `GHSA-3rm2-h79c-8qw6`, `CVE-2026-84992` · npm `md-editor-v3`: affected `<6.5.4`, fixed in `6.5.4` · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)](https://agentprime.io/advisories/GHSA-9rcc-pmj8-ffhr.md) `GHSA-9rcc-pmj8-ffhr`, `CVE-2026-116891`, `PKSA-rt5h-3dwq-vdnx` · Packagist `mediawiki/semantic-media-wiki`: affected `>=4.2.0, <7.2.1`, fixed in `7.2.1` · CVSS 5.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki affected by reflected XSS in \`Special:Ask\` via a forged cursor pagination token](https://agentprime.io/advisories/GHSA-cx86-7xwp-w9wf.md) `GHSA-cx86-7xwp-w9wf`, `CVE-2026-77616`, `PKSA-yxd8-n1ty-bgkg` · Packagist `mediawiki/semantic-media-wiki`: affected `>=7.0.0, <7.2.0`, fixed in `7.2.0` · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki has a query debug output XSS (\`DebugFormatter\`)](https://agentprime.io/advisories/GHSA-q5fm-9mx6-44f4.md) `GHSA-q5fm-9mx6-44f4`, `CVE-2026-77610`, `PKSA-5kcn-7vbr-1pdw` · Packagist `mediawiki/semantic-media-wiki`: affected `<7.2.0`, fixed in `7.2.0` · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki affected by Special:Ask table \`sep\` parameter reflected XSS](https://agentprime.io/advisories/GHSA-7xv3-gf2g-498h.md) `GHSA-7xv3-gf2g-498h`, `CVE-2026-77607`, `PKSA-stqx-crkb-215f` · Packagist `mediawiki/semantic-media-wiki`: affected `<7.2.0`, fixed in `7.2.0` · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki has reflected XSS in \`Special:SearchByProperty\` (\`property\` and \`value\` parameters)](https://agentprime.io/advisories/GHSA-59xw-qv23-j3rc.md) `GHSA-59xw-qv23-j3rc`, `CVE-2026-77608`, `PKSA-2trz-n7bz-xg2h` · Packagist `mediawiki/semantic-media-wiki`: affected `<7.2.0`, fixed in `7.2.0` · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki has reflected XSS in Special:Ask plain table headers](https://agentprime.io/advisories/GHSA-3jp5-3h47-28qf.md) `GHSA-3jp5-3h47-28qf`, `CVE-2026-77606`, `PKSA-6xyn-p8dg-1kgj` · Packagist `mediawiki/semantic-media-wiki`: affected `<7.2.0`, fixed in `7.2.0` · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes](https://agentprime.io/advisories/GHSA-hg8h-557g-q8pp.md) `GHSA-hg8h-557g-q8pp`, `CVE-2025-61682`, `PKSA-q8ty-xz99-jhhj` · Packagist `mediawiki/semantic-media-wiki`: affected `>=3.1.0, <7.0.0`, fixed in `7.0.0` · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent](https://agentprime.io/advisories/CVE-2026-1037.md) `CVE-2026-1037` · CVE record: IBM Common Licensing · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent](https://agentprime.io/advisories/CVE-2026-1031.md) `CVE-2026-1031` · CVE record: IBM Common Licensing · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent](https://agentprime.io/advisories/CVE-2026-1029.md) `CVE-2026-1029` · CVE record: IBM Common Licensing · CVSS 5.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent](https://agentprime.io/advisories/CVE-2026-1025.md) `CVE-2026-1025` · CVE record: IBM Common Licensing · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.](https://agentprime.io/advisories/CVE-2025-36147.md) `CVE-2025-36147` · CVE record: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS Community Store before 2.7.8 Stored XSS](https://agentprime.io/advisories/CVE-2026-93659.md) `CVE-2026-93659` · CVE record: concretecms-community-store community_store · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [SveltyCMS SVG Media Upload media-service.server.ts cross site scripting](https://agentprime.io/advisories/CVE-2026-93505.md) `CVE-2026-93505` · CVE record: SveltyCMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text](https://agentprime.io/advisories/GHSA-m6c8-jcw2-5r25.md) `GHSA-m6c8-jcw2-5r25`, `CVE-2026-77615` · Maven `org.opencastproject:opencast-engage-paella-player-7` and 1 more: affected `<19.7 || >=20.0, <20.2`, fixed in `19.7`, `20.2` · CVSS 8.7 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values\[Name\] Parameter](https://agentprime.io/advisories/CVE-2026-87915.md) `CVE-2026-87915` · CVE record: danieliser Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder · CVSS 7.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title](https://agentprime.io/advisories/CVE-2026-15797.md) `CVE-2026-15797` · CVE record: danieliser Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder · CVSS 6.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint](https://agentprime.io/advisories/CVE-2026-90884.md) `CVE-2026-90884` · CVE record: brechtvds WP Recipe Maker · CVSS 5.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content](https://agentprime.io/advisories/CVE-2026-18405.md) `CVE-2026-18405` · CVE record: jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress · CVSS 7.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex](https://agentprime.io/advisories/CVE-2026-83561.md) `CVE-2026-83561` · CVE record: complianz Complianz GDPR/CCPA Cookie Consent Banner · CVSS 7.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) - [CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields](https://agentprime.io/advisories/CVE-2025-13533.md) `CVE-2025-13533` · CVE record: wipeoutmedia CSS & JavaScript Toolbox · CVSS 4.4 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .