# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Mitel MiVoice Office 400 stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-104807.md)
  `CVE-2026-104807` · CVE record: Mitel Mitel MiVoice Office 400 · CVSS 1.9 Low · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-104400.md)
  `CVE-2026-104400` · CVE record: bPlugins B Blocks · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-104409.md)
  `CVE-2026-104409` · CVE record: WP Chill Image Photo Gallery Final Tiles Grid · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS)
- [code-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting](https://agentprime.io/advisories/CVE-2026-105188.md)
  `CVE-2026-105188` · CVE record: code-projects Human Resource Management System · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Human Resource Management Event Creation EventStore.php cross site scripting](https://agentprime.io/advisories/CVE-2026-105173.md)
  `CVE-2026-105173` · CVE record: code-projects Human Resource Management · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.](https://agentprime.io/advisories/CVE-2026-95166.md)
  `CVE-2026-95166` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.](https://agentprime.io/advisories/CVE-2026-95165.md)
  `CVE-2026-95165` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files](https://agentprime.io/advisories/CVE-2026-105220.md)
  `CVE-2026-105220` · CVE record: klembot twinejs · CVSS 8.5 High · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title](https://agentprime.io/advisories/CVE-2026-105086.md)
  `CVE-2026-105086` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.6.7 Stored XSS via Bazar valeur Action](https://agentprime.io/advisories/CVE-2026-105224.md)
  `CVE-2026-105224` · CVE record: YesWiki yeswiki · CVSS 5.1 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates](https://agentprime.io/advisories/CVE-2026-105089.md)
  `CVE-2026-105089` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-103344.md)
  `CVE-2026-103344` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 7.1 High · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-103062.md)
  `CVE-2026-103062` · CVE record: Cozmoslabs TranslatePress · CVSS 7.1 High · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97276.md)
  `CVE-2026-97276` · CVE record: VeronaLabs WP Statistics · CVSS 7.1 High · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-103354.md)
  `CVE-2026-103354` · CVE record: Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks · CVSS 7.1 High · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials](https://agentprime.io/advisories/CVE-2026-104119.md)
  `CVE-2026-104119` · CVE record: Unknown Simple Shopping Cart · CVSS 3.5 Low · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field](https://agentprime.io/advisories/CVE-2026-17005.md)
  `CVE-2026-17005` · CVE record: Unknown Horizontal scrolling announcements · CVSS 6.8 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting](https://agentprime.io/advisories/CVE-2026-105099.md)
  `CVE-2026-105099` · CVE record: Omega Solution CoinEx Crypto · CVSS 5.1 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments](https://agentprime.io/advisories/CVE-2026-105124.md)
  `CVE-2026-105124` · CVE record: vincent-peugnet wcms · CVSS 5.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-103342.md)
  `CVE-2026-103342` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 7.1 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page](https://agentprime.io/advisories/CVE-2026-105116.md)
  `CVE-2026-105116` · CVE record: OpenIdentityPlatform OpenAM · CVSS 5.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page](https://agentprime.io/advisories/CVE-2026-105114.md)
  `CVE-2026-105114` · CVE record: OpenIdentityPlatform OpenAM · CVSS 5.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-92767.md)
  `CVE-2026-92767` · CVE record: zayedbaloch Twenty20 Image Before-After · CVSS 6.4 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter](https://agentprime.io/advisories/CVE-2026-104313.md)
  `CVE-2026-104313` · CVE record: wpclever WPC Estimated Delivery Date for WooCommerce · CVSS 6.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message](https://agentprime.io/advisories/CVE-2026-93889.md)
  `CVE-2026-93889` · CVE record: wardee Mail logging & Catcher · CVSS 7.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI](https://agentprime.io/advisories/CVE-2026-93896.md)
  `CVE-2026-93896` · CVE record: syammohanm WPFront Notification Bar · CVSS 6.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter](https://agentprime.io/advisories/CVE-2026-92974.md)
  `CVE-2026-92974` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Responsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-15795.md)
  `CVE-2026-15795` · CVE record: cyberchimps Responsive Starter Templates – Elementor Templates & Starter Sites · CVSS 6.4 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-\* Array Key via Multipart Field Name](https://agentprime.io/advisories/CVE-2026-97660.md)
  `CVE-2026-97660` · CVE record: wpclever WPC Product Options for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/\<value>/0' Path Segment](https://agentprime.io/advisories/CVE-2026-103421.md)
  `CVE-2026-103421` · CVE record: amauric WPMobile.App – Android and iOS App Builder · CVSS 5.4 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration](https://agentprime.io/advisories/CVE-2026-94239.md)
  `CVE-2026-94239` · CVE record: Unknown Loco Translate · CVSS 6.8 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content](https://agentprime.io/advisories/CVE-2026-88783.md)
  `CVE-2026-88783` · CVE record: Unknown Kubio AI Page Builder · CVSS 8.8 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute](https://agentprime.io/advisories/CVE-2026-88782.md)
  `CVE-2026-88782` · CVE record: Unknown Kubio AI Page Builder · CVSS 6.8 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload](https://agentprime.io/advisories/CVE-2026-80517.md)
  `CVE-2026-80517` · CVE record: Unknown WP Ultimate CSV Importer · CVSS 3.5 Low · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings](https://agentprime.io/advisories/CVE-2026-101162.md)
  `CVE-2026-101162` · CVE record: Unknown WP Ultimate Review · CVSS 6.4 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission](https://agentprime.io/advisories/CVE-2026-101159.md)
  `CVE-2026-101159` · CVE record: Unknown WP Ultimate Review · CVSS 7.5 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter](https://agentprime.io/advisories/CVE-2026-103888.md)
  `CVE-2026-103888` · CVE record: wpclever WPC Smart Quick View for WooCommerce · CVSS 6.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation](https://agentprime.io/advisories/CVE-2026-103909.md)
  `CVE-2026-103909` · CVE record: codepeople Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More · CVSS 6.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder](https://agentprime.io/advisories/CVE-2026-96575.md)
  `CVE-2026-96575` · CVE record: ivijanstefan Transliterator – Multilingual and Multi-script Text Conversion · CVSS 7.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)](https://agentprime.io/advisories/CVE-2026-100148.md)
  `CVE-2026-100148` · CVE record: widgetpack Rich Showcase for Google Reviews · CVSS 6.4 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter](https://agentprime.io/advisories/CVE-2026-101357.md)
  `CVE-2026-101357` · CVE record: rainbowgeek SEOPress – AI SEO Plugin & On-site SEO · CVSS 4.9 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters](https://agentprime.io/advisories/CVE-2026-87091.md)
  `CVE-2026-87091` · CVE record: uscnanbu Welcart e-Commerce · CVSS 7.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget](https://agentprime.io/advisories/CVE-2025-12828.md)
  `CVE-2025-12828` · CVE record: ultrapressorg Ultra Addons Lite for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author](https://agentprime.io/advisories/CVE-2026-101928.md)
  `CVE-2026-101928` · CVE record: magicplugins Magic Tooltips For Contact Form 7 · CVSS 7.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name](https://agentprime.io/advisories/CVE-2026-96564.md)
  `CVE-2026-96564` · CVE record: rainbowgeek SEOPress – AI SEO Plugin & On-site SEO · CVSS 7.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field](https://agentprime.io/advisories/CVE-2026-96650.md)
  `CVE-2026-96650` · CVE record: wpchill Strong Testimonials · CVSS 7.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX](https://agentprime.io/advisories/CVE-2026-93430.md)
  `CVE-2026-93430` · CVE record: gdragon GD Rating System · CVSS 7.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header](https://agentprime.io/advisories/CVE-2026-97341.md)
  `CVE-2026-97341` · CVE record: wp-buy Visitor Traffic Real Time Statistics · CVSS 7.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write](https://agentprime.io/advisories/CVE-2026-97344.md)
  `CVE-2026-97344` · CVE record: roxnor Wp Social Login and Register Social Counter · CVSS 6.4 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute](https://agentprime.io/advisories/CVE-2026-92727.md)
  `CVE-2026-92727` · CVE record: wpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents · CVSS 6.4 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-92538.md)
  `CVE-2026-92538` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key](https://agentprime.io/advisories/CVE-2026-92826.md)
  `CVE-2026-92826` · CVE record: nosilver4u EWWW Image Optimizer · CVSS 6.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment](https://agentprime.io/advisories/CVE-2026-92977.md)
  `CVE-2026-92977` · CVE record: devowl Real Cookie Banner: GDPR & ePrivacy Cookie Consent · CVSS 7.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter](https://agentprime.io/advisories/CVE-2026-92551.md)
  `CVE-2026-92551` · CVE record: properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress · CVSS 6.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter](https://agentprime.io/advisories/CVE-2026-92243.md)
  `CVE-2026-92243` · CVE record: vinod-dalvi Ivory Search – WordPress Search Plugin · CVSS 6.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter](https://agentprime.io/advisories/CVE-2026-94378.md)
  `CVE-2026-94378` · CVE record: psmplugins SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent · CVSS 6.4 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment](https://agentprime.io/advisories/CVE-2026-100180.md)
  `CVE-2026-100180` · CVE record: jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress · CVSS 5.4 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter](https://agentprime.io/advisories/CVE-2026-96270.md)
  `CVE-2026-96270` · CVE record: ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin · CVSS 7.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Shopclass before 6.2.0 Stored XSS via Listing Description Field](https://agentprime.io/advisories/CVE-2026-104479.md)
  `CVE-2026-104479` · CVE record: mindstellar shopclass · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Showdown through 2.1.0 XSS via unescaped quote in href and src attributes](https://agentprime.io/advisories/CVE-2026-104477.md)
  `CVE-2026-104477` · CVE record: showdownjs showdown · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTAyVDIzOjI4OjQ3LjQxNDAwMFoiLCJDVkUtMjAyNi0xMDQ0NzciXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTA1VDA4OjMwOjU0LjkwOTAwMFoiLCJDVkUtMjAyNi0xMDQ4MDgiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTA1VDA4OjMwOjU0LjkwOTAwMFoiLCJDVkUtMjAyNi0xMDQ4MDgiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.