# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Ghost: Stored XSS via SVG Uploads Bypassing Sanitization](https://agentprime.io/advisories/GHSA-8575-cr6v-7jh4.md)
  `GHSA-8575-cr6v-7jh4`, `BIT-ghost-2026-105649`, `CVE-2026-105649` · npm `ghost`: affected `>=4.22.0, <6.65.0`, fixed in `6.65.0` · CVSS 7.3 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Payload: Bypassed sanitization of user uploaded SVGs](https://agentprime.io/advisories/GHSA-2pwp-2369-8fg3.md)
  `GHSA-2pwp-2369-8fg3`, `CVE-2026-105862` · npm `payload`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Ghost: Stored XSS via oEmbed Photo Responses](https://agentprime.io/advisories/GHSA-v3xr-g6p2-fvgv.md)
  `GHSA-v3xr-g6p2-fvgv`, `BIT-ghost-2026-104414`, `BIT-ghost-2026-105650`, `CVE-2026-104414`, `CVE-2026-105650` · npm `ghost`: affected `>=2.5.0, <6.64.0`, fixed in `6.64.0` · CVSS 8.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-184
- [Ghost: Stored XSS via Bookmark Card Images](https://agentprime.io/advisories/GHSA-347q-26qq-h2p6.md)
  `GHSA-347q-26qq-h2p6`, `BIT-ghost-2026-104413`, `BIT-ghost-2026-105651`, `CVE-2026-104413`, `CVE-2026-105651` · npm `ghost`: affected `>=5.94.0, <6.64.0`, fixed in `6.64.0` · CVSS 8.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Ghost: Stored XSS via File Uploads on Local Storage](https://agentprime.io/advisories/GHSA-gfjp-2p8f-94qv.md)
  `GHSA-gfjp-2p8f-94qv`, `BIT-ghost-2026-104411`, `BIT-ghost-2026-105679`, `CVE-2026-104411`, `CVE-2026-105679` · npm `ghost`: affected `>=6.22.1, <6.64.0`, fixed in `6.64.0` · CVSS 8.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-95595.md)
  `CVE-2026-95595` · CVE record: Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94670.md)
  `CVE-2026-94670` · CVE record: Everest Forms Everest Forms · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94662.md)
  `CVE-2026-94662` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its \</script> escape is bypassable](https://agentprime.io/advisories/GHSA-r5mf-4r5x-q78f.md)
  `GHSA-r5mf-4r5x-q78f`, `CVE-2026-106106` · npm `@quasar/app-vite` and 1 more: affected `<3.3.0`, fixed in `3.3.0` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), Information disclosure
- [Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained](https://agentprime.io/advisories/GHSA-5m6h-8g35-p3m7.md)
  `GHSA-5m6h-8g35-p3m7`, `CVE-2026-106107` · npm `@quasar/app-vite`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 8.3 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()](https://agentprime.io/advisories/GHSA-pq96-jpmf-w254.md)
  `GHSA-pq96-jpmf-w254`, `CVE-2026-106102` · npm `quasar`: affected `<2.22.0`, fixed in `2.22.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages](https://agentprime.io/advisories/CVE-2026-107272.md)
  `CVE-2026-107272` · CVE record: gophish gophish · CVSS 2.3 Low · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in SonicWall SMA1000](https://agentprime.io/advisories/CVE-2026-102258.md)
  `CVE-2026-102258` · CVE record: SonicWall SMA1000 · CVSS 6.1 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-104393.md)
  `CVE-2026-104393` · CVE record: weDevs Happy Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-105875.md)
  `CVE-2026-105875` · CVE record: BdThemes Prime Slider – Addons For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-104391.md)
  `CVE-2026-104391` · CVE record: ExpressTech Quiz And Survey Master · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-105884.md)
  `CVE-2026-105884` · CVE record: WP Media Rocket Lazy Load · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-105873.md)
  `CVE-2026-105873` · CVE record: BdThemes Element Pack Elementor Addons · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97294.md)
  `CVE-2026-97294` · CVE record: David Lingren Media LIbrary Assistant · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-105871.md)
  `CVE-2026-105871` · CVE record: BdThemes Element Pack Elementor Addons · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Veeam Backup Enterprise Manager](https://agentprime.io/advisories/CVE-2025-64392.md)
  `CVE-2025-64392` · CVE record: Veeam Backup Enterprise Manager · CVSS 4.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Apache Impala: Stored XSS in Impala query plans](https://agentprime.io/advisories/CVE-2026-93684.md)
  `CVE-2026-93684` · CVE record: Apache Software Foundation Apache Impala · CVSS 5.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed](https://agentprime.io/advisories/CVE-2026-89417.md)
  `CVE-2026-89417` · CVE record: daanvandenbergh OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. · CVSS 7.2 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter](https://agentprime.io/advisories/CVE-2026-87971.md)
  `CVE-2026-87971` · CVE record: Unknown If-So Dynamic Content · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions](https://agentprime.io/advisories/CVE-2026-105316.md)
  `CVE-2026-105316` · CVE record: Unknown Magee Shortcodes · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions](https://agentprime.io/advisories/CVE-2026-104653.md)
  `CVE-2026-104653` · CVE record: Unknown Envira Gallery · CVSS 6.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID](https://agentprime.io/advisories/CVE-2026-104652.md)
  `CVE-2026-104652` · CVE record: Unknown Envira Gallery · CVSS 6.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata](https://agentprime.io/advisories/CVE-2026-102173.md)
  `CVE-2026-102173` · CVE record: themeum Kirki – Freeform Page Builder, Website Builder & Customizer · CVSS 7.2 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in ASUS Router](https://agentprime.io/advisories/CVE-2026-14911.md)
  `CVE-2026-14911` · CVE record: ASUS Router · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data.](https://agentprime.io/advisories/CVE-2025-70519.md)
  `CVE-2025-70519` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data.](https://agentprime.io/advisories/CVE-2025-70515.md)
  `CVE-2025-70515` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Gitea repository media API stored XSS](https://agentprime.io/advisories/CVE-2026-96594.md)
  `CVE-2026-96594` · CVE record: Gitea Gitea · CVSS 6.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS](https://agentprime.io/advisories/CVE-2026-105111.md)
  `CVE-2026-105111` · CVE record: Apache Software Foundation Apache Commons BCEL · CVSS 2.3 Low · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Security Advisory 0192](https://agentprime.io/advisories/CVE-2026-101157.md)
  `CVE-2026-101157` · CVE record: Arista Networks CloudVision CUE · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Security Advisory 0192](https://agentprime.io/advisories/CVE-2026-101156.md)
  `CVE-2026-101156` · CVE record: Arista Networks CloudVision CUE · CVSS 6.2 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Security Advisory 0185](https://agentprime.io/advisories/CVE-2026-101158.md)
  `CVE-2026-101158` · CVE record: Arista Networks CloudVision Portal · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Gitea container registry stored XSS through blob media type](https://agentprime.io/advisories/CVE-2026-103667.md)
  `CVE-2026-103667` · CVE record: Gitea Gitea · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Unauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy Manager Client Interface](https://agentprime.io/advisories/CVE-2026-79816.md)
  `CVE-2026-79816` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in ClearPass Policy Manager Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-79799.md)
  `CVE-2026-79799` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links](https://agentprime.io/advisories/CVE-2026-104073.md)
  `CVE-2026-104073` · CVE record: netbox-community netbox · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS), Information disclosure
- [MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS](https://agentprime.io/advisories/CVE-2026-106512.md)
  `CVE-2026-106512` · CVE record: MISP sachertortephp · CVSS 8.4 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS), Other injection, CWE-20
- [Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter](https://agentprime.io/advisories/CVE-2026-106033.md)
  `CVE-2026-106033` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting](https://agentprime.io/advisories/CVE-2026-105950.md)
  `CVE-2026-105950` · CVE record: getformwork formwork · CVSS 5.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SimpleChat: Stored XSS via group document filename in inline onclick handler](https://agentprime.io/advisories/CVE-2026-105798.md)
  `CVE-2026-105798` · CVE record: microsoft simplechat · CVSS 8.7 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting (XSS) vulnerability identified in OpenText™ Content Management](https://agentprime.io/advisories/CVE-2025-15591.md)
  `CVE-2025-15591` · CVE record: OpenText Content Management · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Reflected XSS in Akıllı Ticaret's E-Commerce Pack](https://agentprime.io/advisories/CVE-2026-12380.md)
  `CVE-2026-12380` · CVE record: Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack · CVSS 6.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-105061.md)
  `CVE-2026-105061` · CVE record: Bởi brandtoss WP Mailster · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-104814.md)
  `CVE-2026-104814` · CVE record: epiphyt Form Block · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-104672.md)
  `CVE-2026-104672` · CVE record: Nexcess GiveWP · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-104670.md)
  `CVE-2026-104670` · CVE record: ThimPress LearnPress · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-104395.md)
  `CVE-2026-104395` · CVE record: picu picu · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-104394.md)
  `CVE-2026-104394` · CVE record: Syed Balkhi Charitable · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94675.md)
  `CVE-2026-94675` · CVE record: Fluent Forms Free vs Pro Fluent Forms Pro Add On Pack · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42636.md)
  `CVE-2026-42636` · CVE record: WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42635.md)
  `CVE-2026-42635` · CVE record: wpgenie WooCommerce Simple Auctions · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42634.md)
  `CVE-2026-42634` · CVE record: bPlugins Video Background Block – Use video as background in the section. · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42418.md)
  `CVE-2026-42418` · CVE record: Socialrocket Social Rocket · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-40807.md)
  `CVE-2026-40807` · CVE record: Aman CF7 Views \&#8211; Complete Entry Management for Contact Form 7 · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-40806.md)
  `CVE-2026-40806` · CVE record: Plugin Devs Blog, Posts and Category Filter for Elementor · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-39790.md)
  `CVE-2026-39790` · CVE record: e4jvikwp VikRentCar · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTA2VDA4OjM0OjQzLjYzOTAwMFoiLCJDVkUtMjAyNi0zOTc5MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTA3VDIwOjQzOjAzLjAwMDAwMFoiLCJHSFNBLWhxcTIteHFyMi1mbXgyIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTA3VDIwOjQzOjAzLjAwMDAwMFoiLCJHSFNBLWhxcTIteHFyMi1mbXgyIl0>. Everything for agents: <https://agentprime.io/llms.txt>.