# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97065.md)
  `CVE-2026-97065` · CVE record: Happyforms Happyforms · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96836.md)
  `CVE-2026-96836` · CVE record: Morteza Geransayeh Parsi Date · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96835.md)
  `CVE-2026-96835` · CVE record: KingAddons.com King Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96830.md)
  `CVE-2026-96830` · CVE record: Nexcess GiveWP · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96829.md)
  `CVE-2026-96829` · CVE record: POSIMYTH The Plus Addons for Elementor Page Builder Lite · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96820.md)
  `CVE-2026-96820` · CVE record: awesomesupport Awesome Support · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96819.md)
  `CVE-2026-96819` · CVE record: bobbingwide oik · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96816.md)
  `CVE-2026-96816` · CVE record: vendidero Trusted Shops Easy Integration for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96814.md)
  `CVE-2026-96814` · CVE record: WP Titan Labs WooCommerce Product Table Lite · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96450.md)
  `CVE-2026-96450` · CVE record: pixfort pixfort Core · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96352.md)
  `CVE-2026-96352` · CVE record: YITHEMES YITH WooCommerce Ajax Search · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96351.md)
  `CVE-2026-96351` · CVE record: RadiusTheme Classified Listing · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96338.md)
  `CVE-2026-96338` · CVE record: Cozmoslabs Profile Builder · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94674.md)
  `CVE-2026-94674` · CVE record: SweetCode Pixel Manager for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94081.md)
  `CVE-2026-94081` · CVE record: lukeseager WordPress Persistent Login · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94078.md)
  `CVE-2026-94078` · CVE record: Gemini Labs Site Reviews · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94077.md)
  `CVE-2026-94077` · CVE record: 10up Safe SVG · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-93770.md)
  `CVE-2026-93770` · CVE record: VeronaLabs WP Statistics · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-93514.md)
  `CVE-2026-93514` · CVE record: rainafarai Notification for Telegram · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-93512.md)
  `CVE-2026-93512` · CVE record: ilGhera JW Player for WordPress · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62080.md)
  `CVE-2026-62080` · CVE record: Leevio Happy Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62079.md)
  `CVE-2026-62079` · CVE record: Qode Qi Addons For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62078.md)
  `CVE-2026-62078` · CVE record: Leap13 Premium Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-27371.md)
  `CVE-2026-27371` · CVE record: WPFunnels WPFunnels · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27085.md)
  `CVE-2026-27085` · CVE record: Brainstorm Force Astra WordPress Theme · CVSS 2.7 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image](https://agentprime.io/advisories/CVE-2026-103321.md)
  `CVE-2026-103321` · CVE record: MISP MISP · CVSS 8.3 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20
- [Moodle: xss via password reset link due to insufficient username escaping](https://agentprime.io/advisories/CVE-2026-102586.md)
  `CVE-2026-102586` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Moodle: xss in forum post templates due to insufficient escaping](https://agentprime.io/advisories/CVE-2026-102581.md)
  `CVE-2026-102581` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting](https://agentprime.io/advisories/CVE-2026-102459.md)
  `CVE-2026-102459` · CVE record: DigiWin EasyFlow .NET · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter](https://agentprime.io/advisories/CVE-2026-92712.md)
  `CVE-2026-92712` · CVE record: rockiger ReactPress – Create React App for WordPress · CVSS 6.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload](https://agentprime.io/advisories/CVE-2025-14564.md)
  `CVE-2025-14564` · CVE record: ahsangadit Viable URL Media Uploader · CVSS 6.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter](https://agentprime.io/advisories/CVE-2026-93908.md)
  `CVE-2026-93908` · CVE record: rameez_iqbal Real Estate Manager – Property Listing and Agent Management · CVSS 6.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header](https://agentprime.io/advisories/CVE-2026-97347.md)
  `CVE-2026-97347` · CVE record: kazukiyanamoto Post Views Stats Counter · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter](https://agentprime.io/advisories/CVE-2026-6173.md)
  `CVE-2026-6173` · CVE record: boldthemes Bold Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-6170.md)
  `CVE-2026-6170` · CVE record: boldthemes Bold Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-6171.md)
  `CVE-2026-6171` · CVE record: boldthemes Bold Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block](https://agentprime.io/advisories/CVE-2026-14876.md)
  `CVE-2026-14876` · CVE record: nextendweb Smart Slider 3 · CVSS 6.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting](https://agentprime.io/advisories/CVE-2026-11895.md)
  `CVE-2026-11895` · CVE record: devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder · CVSS 6.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title](https://agentprime.io/advisories/CVE-2026-88037.md)
  `CVE-2026-88037` · CVE record: boldthemes Bold Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter](https://agentprime.io/advisories/CVE-2026-6172.md)
  `CVE-2026-6172` · CVE record: boldthemes Bold Page Builder · CVSS 6.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in baserCMS](https://agentprime.io/advisories/CVE-2026-93464.md)
  `CVE-2026-93464` · CVE record: baserCMS User Community baserCMS · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in baserCMS](https://agentprime.io/advisories/CVE-2026-93460.md)
  `CVE-2026-93460` · CVE record: baserCMS User Community baserCMS · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in baserCMS](https://agentprime.io/advisories/CVE-2026-93463.md)
  `CVE-2026-93463` · CVE record: baserCMS User Community baserCMS · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API](https://agentprime.io/advisories/CVE-2026-92994.md)
  `CVE-2026-92994` · CVE record: Unknown Verge3D Publishing and E-Commerce · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue](https://agentprime.io/advisories/CVE-2026-92424.md)
  `CVE-2026-92424` · CVE record: Unknown Content Egg · CVSS 6.8 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF](https://agentprime.io/advisories/CVE-2026-91832.md)
  `CVE-2026-91832` · CVE record: Unknown WP Mobile Menu · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser](https://agentprime.io/advisories/CVE-2026-89193.md)
  `CVE-2026-89193` · CVE record: Unknown Robin Image Optimizer · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute](https://agentprime.io/advisories/CVE-2026-87777.md)
  `CVE-2026-87777` · CVE record: Unknown Hostinger Reach · CVSS 6.8 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload](https://agentprime.io/advisories/CVE-2026-85573.md)
  `CVE-2026-85573` · CVE record: Unknown All in One Files Upload · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL](https://agentprime.io/advisories/CVE-2026-85415.md)
  `CVE-2026-85415` · CVE record: Unknown Audio Player Block · CVSS 6.8 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute](https://agentprime.io/advisories/CVE-2026-85001.md)
  `CVE-2026-85001` · CVE record: Unknown EmbedPress · CVSS 6.8 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields](https://agentprime.io/advisories/CVE-2026-82127.md)
  `CVE-2026-82127` · CVE record: Unknown Schema & Structured Data for WP & AMP · CVSS 3.5 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)](https://agentprime.io/advisories/CVE-2026-96649.md)
  `CVE-2026-96649` · CVE record: wpshuffle Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [gedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting](https://agentprime.io/advisories/CVE-2026-102847.md)
  `CVE-2026-102847` · CVE record: gedelumbung HospitalManagement · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Stored i18n XSSs in CentralNotice](https://agentprime.io/advisories/CVE-2026-103051.md)
  `CVE-2026-103051` · CVE record: The Wikimedia Foundation Mediawiki - CentralNotice extension · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored i18n XSS in MassMessage](https://agentprime.io/advisories/CVE-2026-103050.md)
  `CVE-2026-103050` · CVE record: The Wikimedia Foundation Mediawiki - MassMessage extension · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [XSS in Cargo's Special:CargoQuery page due to unsanitized table headers](https://agentprime.io/advisories/CVE-2026-103049.md)
  `CVE-2026-103049` · CVE record: The Wikimedia Foundation Mediawiki - Cargo extension · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [XSS through i18n message in CentralAuth](https://agentprime.io/advisories/CVE-2026-103047.md)
  `CVE-2026-103047` · CVE record: The Wikimedia Foundation Mediawiki - CentralAuth extension · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [XSS in Refreshed skin](https://agentprime.io/advisories/CVE-2026-103045.md)
  `CVE-2026-103045` · CVE record: The Wikimedia Foundation Mediawiki - Refreshed skin · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML](https://agentprime.io/advisories/CVE-2026-103046.md)
  `CVE-2026-103046` · CVE record: The Wikimedia Foundation Mediawiki - WikiLambda Extension · CVSS 6.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTA5LTI5VDIyOjQxOjM2LjA5OTAwMFoiLCJDVkUtMjAyNi0xMDMwNDYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTA5LTMwVDEyOjI3OjUwLjkyMzAwMFoiLCJDVkUtMjAyNi05NzA2NyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTA5LTMwVDEyOjI3OjUwLjkyMzAwMFoiLCJDVkUtMjAyNi05NzA2NyJd>. Everything for agents: <https://agentprime.io/llms.txt>.