# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75684.md)
  `CVE-2026-75684` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75697.md)
  `CVE-2026-75697` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting](https://agentprime.io/advisories/CVE-2026-95657.md)
  `CVE-2026-95657` · CVE record: dgtlmoon Changedetection.io · CVSS 5.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View](https://agentprime.io/advisories/CVE-2026-95682.md)
  `CVE-2026-95682` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON](https://agentprime.io/advisories/CVE-2026-95665.md)
  `CVE-2026-95665` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [sfturing hosp_order Public Search Handlers HospitalController.java cross site scripting](https://agentprime.io/advisories/CVE-2026-95396.md)
  `CVE-2026-95396` · CVE record: sfturing hosp_order · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List](https://agentprime.io/advisories/CVE-2026-95661.md)
  `CVE-2026-95661` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread](https://agentprime.io/advisories/CVE-2026-95659.md)
  `CVE-2026-95659` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116
- [WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter](https://agentprime.io/advisories/CVE-2026-93836.md)
  `CVE-2026-93836` · CVE record: wpclever WPC Product Bundles for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)](https://agentprime.io/advisories/CVE-2026-93778.md)
  `CVE-2026-93778` · CVE record: jgwhite33 WP Yelp Review Slider · CVSS 7.2 High · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Hostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting](https://agentprime.io/advisories/CVE-2026-1645.md)
  `CVE-2026-1645` · CVE record: prasunsen Hostel · CVSS 4.4 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content](https://agentprime.io/advisories/CVE-2026-16778.md)
  `CVE-2026-16778` · CVE record: livecomposer Live Composer – Free WordPress Website Builder · CVSS 6.4 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin](https://agentprime.io/advisories/CVE-2026-92438.md)
  `CVE-2026-92438` · CVE record: Unknown Ninja Forms · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-94504.md)
  `CVE-2026-94504` · CVE record: kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder · CVSS 7.2 High · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel](https://agentprime.io/advisories/CVE-2026-89412.md)
  `CVE-2026-89412` · CVE record: cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation · CVSS 7.2 High · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Text Styler <= 1.1.1 - Contributor+ Stored XSS](https://agentprime.io/advisories/CVE-2026-88788.md)
  `CVE-2026-88788` · CVE record: Unknown Text Styler · CVSS 6.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter](https://agentprime.io/advisories/CVE-2026-93655.md)
  `CVE-2026-93655` · CVE record: wpdevelop Booking Calendar · CVSS 6.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter](https://agentprime.io/advisories/CVE-2026-85653.md)
  `CVE-2026-85653` · CVE record: ajay Contextual Related Posts · CVSS 6.4 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS).](https://agentprime.io/advisories/CVE-2026-88415.md)
  `CVE-2026-88415` · CVE record · CVSS 8.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [A reflected cross-site scripting vulnerability exists in x-ui 0.3.2.](https://agentprime.io/advisories/CVE-2026-79315.md)
  `CVE-2026-79315` · CVE record · CVSS 4.7 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.\_\_init\_\_().](https://agentprime.io/advisories/CVE-2026-79311.md)
  `CVE-2026-79311` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [xuxueli xxl-job insert cross site scripting](https://agentprime.io/advisories/CVE-2026-94426.md)
  `CVE-2026-94426` · CVE record: xuxueli xxl-job · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Discourse: Stored XSS via unescaped actor name in post actions](https://agentprime.io/advisories/CVE-2026-59830.md)
  `CVE-2026-59830` · CVE record: discourse discourse · CVSS 5.4 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl](https://agentprime.io/advisories/CVE-2026-46650.md)
  `CVE-2026-46650` · CVE record: laurent22 joplin · CVSS 4.4 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joplin: Stored XSS via inline-served note attachment on published shares](https://agentprime.io/advisories/CVE-2026-59814.md)
  `CVE-2026-59814` · CVE record: laurent22 joplin · CVSS 7.6 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer](https://agentprime.io/advisories/CVE-2026-55105.md)
  `CVE-2026-55105` · CVE record: laurent22 joplin · CVSS 7.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)](https://agentprime.io/advisories/CVE-2026-73546.md)
  `CVE-2026-73546` · CVE record: envoyproxy envoy · CVSS 7.4 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Tautulli: Reflected XSS in \`/search\` endpoint](https://agentprime.io/advisories/CVE-2026-45381.md)
  `CVE-2026-45381` · CVE record: Tautulli Tautulli · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter](https://agentprime.io/advisories/CVE-2026-49995.md)
  `CVE-2026-49995` · CVE record: Tautulli Tautulli · CVSS 4.8 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values](https://agentprime.io/advisories/CVE-2026-91165.md)
  `CVE-2026-91165` · CVE record: warp-tech warpgate · CVSS 2.4 Low · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter](https://agentprime.io/advisories/CVE-2026-58491.md)
  `CVE-2026-58491` · CVE record: warp-tech warpgate · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Telegram Desktop](https://agentprime.io/advisories/CVE-2026-94488.md)
  `CVE-2026-94488` · CVE record: Telegram Telegram Desktop · CVSS 8.3 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642](https://agentprime.io/advisories/CVE-2026-58504.md)
  `CVE-2026-58504` · CVE record: jgraph drawio · CVSS 6.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages](https://agentprime.io/advisories/CVE-2026-52741.md)
  `CVE-2026-52741` · CVE record: gocd gocd · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages](https://agentprime.io/advisories/CVE-2026-68919.md)
  `CVE-2026-68919` · CVE record: gocd gocd · CVSS 7.0 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute](https://agentprime.io/advisories/CVE-2026-93339.md)
  `CVE-2026-93339` · CVE record: Metaphor Creations Ditty · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log](https://agentprime.io/advisories/CVE-2026-94387.md)
  `CVE-2026-94387` · CVE record: Webkul Aureus ERP · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer](https://agentprime.io/advisories/CVE-2025-71419.md)
  `CVE-2025-71419` · CVE record: uvdesk core-framework and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu](https://agentprime.io/advisories/CVE-2026-94373.md)
  `CVE-2026-94373` · CVE record: MISP MISP · CVSS 6.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index](https://agentprime.io/advisories/CVE-2026-94372.md)
  `CVE-2026-94372` · CVE record: MISP MISP · CVSS 6.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Hyve5 Leantime Project Dashboard show.blade.php cross site scripting](https://agentprime.io/advisories/CVE-2026-94211.md)
  `CVE-2026-94211` · CVE record: Hyve5 Leantime · CVSS 4.8 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting](https://agentprime.io/advisories/CVE-2026-94210.md)
  `CVE-2026-94210` · CVE record: Hyve5 Leantime · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platform](https://agentprime.io/advisories/CVE-2026-91921.md)
  `CVE-2026-91921` · CVE record: 1millionbot AI Chatbot Platform (SaaS) de 1millionbot. · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name](https://agentprime.io/advisories/CVE-2026-94277.md)
  `CVE-2026-94277` · CVE record: MISP MISP · CVSS 6.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Omega Solution HRM OS SVG File Upload view cross site scripting](https://agentprime.io/advisories/CVE-2026-94150.md)
  `CVE-2026-94150` · CVE record: Omega Solution HRM OS · CVSS 4.8 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [xuxueli xxl-job Task Management JobInfoController.java cross site scripting](https://agentprime.io/advisories/CVE-2026-94145.md)
  `CVE-2026-94145` · CVE record: xuxueli xxl-job · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.](https://agentprime.io/advisories/CVE-2026-88746.md)
  `CVE-2026-88746` · CVE record · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.](https://agentprime.io/advisories/CVE-2026-88745.md)
  `CVE-2026-88745` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime.](https://agentprime.io/advisories/CVE-2026-79320.md)
  `CVE-2026-79320` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS).](https://agentprime.io/advisories/CVE-2026-36472.md)
  `CVE-2026-36472` · CVE record · CVSS 5.2 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php.](https://agentprime.io/advisories/CVE-2026-36470.md)
  `CVE-2026-36470` · CVE record · CVSS 5.8 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded…](https://agentprime.io/advisories/CVE-2026-36468.md)
  `CVE-2026-36468` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting](https://agentprime.io/advisories/CVE-2026-94045.md)
  `CVE-2026-94045` · CVE record: newbee-ltd newbee-mall · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Drug Recommendation System index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-94035.md)
  `CVE-2026-94035` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Drug Recommendation System Password Change change_password cross site scripting](https://agentprime.io/advisories/CVE-2026-94034.md)
  `CVE-2026-94034` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Drug Recommendation System User Management add_user cross site scripting](https://agentprime.io/advisories/CVE-2026-94033.md)
  `CVE-2026-94033` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Drug Recommendation System add_symptom cross site scripting](https://agentprime.io/advisories/CVE-2026-94016.md)
  `CVE-2026-94016` · CVE record: SourceCodester Drug Recommendation System · CVSS 4.8 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Assessment Management add-single-mark.php cross site scripting](https://agentprime.io/advisories/CVE-2026-93977.md)
  `CVE-2026-93977` · CVE record: code-projects Assessment Management · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Assessment Management add-user.php cross site scripting](https://agentprime.io/advisories/CVE-2026-93976.md)
  `CVE-2026-93976` · CVE record: code-projects Assessment Management · CVSS 4.8 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Assessment Management User Editing edit-user.php cross site scripting](https://agentprime.io/advisories/CVE-2026-93975.md)
  `CVE-2026-93975` · CVE record: code-projects Assessment Management · CVSS 4.8 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTA5LTIwVDA5OjQ1OjA4LjY1MTAwMFoiLCJDVkUtMjAyNi05Mzk3NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTA5LTIyVDE4OjUzOjU5Ljc0MDAwMFoiLCJDVkUtMjAyNi03NTY5OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTA5LTIyVDE4OjUzOjU5Ljc0MDAwMFoiLCJDVkUtMjAyNi03NTY5OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.