# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [hono/jsx renders plain strings unescaped in boundary components, leading to XSS](https://agentprime.io/advisories/GHSA-hxh3-vqpv-xpqv.md) `GHSA-hxh3-vqpv-xpqv`, `CVE-2026-93981` · npm `hono`: affected `<4.13.7`, fixed in `4.13.7` · CVSS 2.3 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [QloApps through 1.7.0 Reflected XSS via Length of Stay Fields](https://agentprime.io/advisories/CVE-2026-103590.md) `CVE-2026-103590` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [QloApps through 1.7.0 Reflected XSS via Room Type Editor](https://agentprime.io/advisories/CVE-2026-103589.md) `CVE-2026-103589` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [QloApps through 1.7.0 Reflected XSS via exceptions field](https://agentprime.io/advisories/CVE-2026-103588.md) `CVE-2026-103588` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters](https://agentprime.io/advisories/CVE-2026-103587.md) `CVE-2026-103587` · CVE record: Webkul QloApps · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [attacker-controlled javascript license URL via XSS](https://agentprime.io/advisories/CVE-2026-103585.md) `CVE-2026-103585` · CVE record: The Wikimedia Foundation MediaWiki MediaSearch extension · CVSS 1.2 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [attacker-controlled javascript license URL via XSS](https://agentprime.io/advisories/CVE-2026-103584.md) `CVE-2026-103584` · CVE record: The Wikimedia Foundation MediaWiki CommonsMetadata extension · CVSS 1.1 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter](https://agentprime.io/advisories/CVE-2026-47096.md) `CVE-2026-47096` · CVE record: AJA Video Systems HELO Plus · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [Kiteworks Core Stored Cross-site Scripting (XSS)](https://agentprime.io/advisories/CVE-2026-102126.md) `CVE-2026-102126` · CVE record: Kiteworks Core · CVSS 8.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [Kiteworks Core stored XSS](https://agentprime.io/advisories/CVE-2026-102100.md) `CVE-2026-102100` · CVE record: Kiteworks Core · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)](https://agentprime.io/advisories/CVE-2026-102147.md) `CVE-2026-102147` · CVE record: Kiteworks Core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [Kiteworks Core stored XSS](https://agentprime.io/advisories/CVE-2026-102092.md) `CVE-2026-102092` · CVE record: Kiteworks Core · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102391.md) `CVE-2026-102391` · CVE record: jetmonsters JetFormBuilder · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102376.md) `CVE-2026-102376` · CVE record: WPMU DEV Branda · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-100510.md) `CVE-2026-100510` · CVE record: BoldGrid Post and Page Builder by BoldGrid · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97290.md) `CVE-2026-97290` · CVE record: Sayontan Sinha Photonic Gallery & Lightbox for Flickr, SmugMug & Others · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97265.md) `CVE-2026-97265` · CVE record: Crocoblock. Jetimpex Inc. JetEngine · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94171.md) `CVE-2026-94171` · CVE record: VillaTheme CURCY · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [Various rawParams() and escaped() updates to prevent XSS in Wikibase extension](https://agentprime.io/advisories/CVE-2026-103439.md) `CVE-2026-103439` · CVE record: The Wikimedia Foundation MediaWiki Wikbase extension · CVSS 0.3 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [Various rawParams() and escaped() updates to prevent XSS in Wikistories extension](https://agentprime.io/advisories/CVE-2026-103438.md) `CVE-2026-103438` · CVE record: The Wikimedia Foundation MediaWiki Wikistories extension · CVSS 0.3 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [ReadingLists imported metadata permits JavaScript URL XSS](https://agentprime.io/advisories/CVE-2026-103437.md) `CVE-2026-103437` · CVE record: The Wikimedia Foundation MediaWiki ReadingLists extension · CVSS 1.1 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS through PageForms #autoedit redirect links](https://agentprime.io/advisories/CVE-2026-103445.md) `CVE-2026-103445` · CVE record: The Wikimedia Foundation MediaWiki Page_Forms extension · CVSS 1.2 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS through system messages in WikiForum](https://agentprime.io/advisories/CVE-2026-103444.md) `CVE-2026-103444` · CVE record: The Wikimedia Foundation MediaWiki WikiForum extension · CVSS 1.1 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [API permits session-seeded javascript URL XSS](https://agentprime.io/advisories/CVE-2026-103443.md) `CVE-2026-103443` · CVE record: The Wikimedia Foundation MediaWiki Collection (Book) extension · CVSS 1.1 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [Serialize JavaScript: Cross-site scripting (XSS) via unescaped \ in serialized function bodies](https://agentprime.io/advisories/GHSA-gfhx-hw2g-v5hg.md) `GHSA-gfhx-hw2g-v5hg`, `CVE-2026-97711` · npm `serialize-javascript`: affected `>=7.1.1, <7.1.2`, fixed in `7.1.2` · CVSS 2.3 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS](https://agentprime.io/advisories/GHSA-p98j-92pf-mc4p.md) `GHSA-p98j-92pf-mc4p`, `CVE-2026-109344` · npm `dompurify`: affected `>=3.4.13, <3.4.16`, fixed in `3.4.16` · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal](https://agentprime.io/advisories/GHSA-97jj-33gv-5xf9.md) `GHSA-97jj-33gv-5xf9`, `CVE-2026-105829`, `PKSA-m2dq-1fhr-29b1` · Packagist `league/commonmark`: affected `>=1.3.0, <2.10.2`, fixed in `2.10.2` · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection, Cross-site scripting (XSS) - [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100275.md) `CVE-2026-100275` · CVE record: JetBrains YouTrack · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100263.md) `CVE-2026-100263` · CVE record: JetBrains YouTrack · CVSS 4.7 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph](https://agentprime.io/advisories/CVE-2026-103389.md) `CVE-2026-103389` · CVE record: MISP MISP · CVSS 6.2 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20 - [MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field](https://agentprime.io/advisories/CVE-2026-103388.md) `CVE-2026-103388` · CVE record: MISP MISP · CVSS 6.2 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62084.md) `CVE-2026-62084` · CVE record: Jeff Starr User Submitted Posts · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102398.md) `CVE-2026-102398` · CVE record: supsystic Popup by Supsystic · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102396.md) `CVE-2026-102396` · CVE record: supsystic Ultimate Maps by Supsystic · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102395.md) `CVE-2026-102395` · CVE record: supsystic Easy Google Maps · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102386.md) `CVE-2026-102386` · CVE record: Jacob N. Breetvelt WP Photo Album Plus · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102385.md) `CVE-2026-102385` · CVE record: Kevin Stover Ninja Forms · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102384.md) `CVE-2026-102384` · CVE record: Supreme Modules Supreme Modules Lite · CVSS 5.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress CF7 Views \– Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-100513.md) `CVE-2026-100513` · CVE record: Aman CF7 Views \– Complete Entry Management for Contact Form 7 · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-100507.md) `CVE-2026-100507` · CVE record: If-So Dynamic Content If-So Dynamic Content Personalization · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97301.md) `CVE-2026-97301` · CVE record: Cool Plugins Cool Formkit Lite · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97298.md) `CVE-2026-97298` · CVE record: KingAddons King Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97292.md) `CVE-2026-97292` · CVE record: YITHEMES YITH WooCommerce Tab Manager · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97289.md) `CVE-2026-97289` · CVE record: ExpressTech Quiz And Survey Master · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97288.md) `CVE-2026-97288` · CVE record: Jayson T Cote OAuth Server · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97286.md) `CVE-2026-97286` · CVE record: WP Chill Strong Testimonials · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97279.md) `CVE-2026-97279` · CVE record: Chouby Polylang · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97272.md) `CVE-2026-97272` · CVE record: Premmerce Premmerce Permalink Manager for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97271.md) `CVE-2026-97271` · CVE record: WPFunnels WPFunnels · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97270.md) `CVE-2026-97270` · CVE record: Justin Sternberg CMB2 · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97266.md) `CVE-2026-97266` · CVE record: Nexcess Virtue/Ascend/Pinnacle Toolkit · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97262.md) `CVE-2026-97262` · CVE record: Visual Composer Visual Composer Website Builder · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97253.md) `CVE-2026-97253` · CVE record: Kreatura LayerSlider · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97250.md) `CVE-2026-97250` · CVE record: Dylan Kuhn Geo Mashup · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97238.md) `CVE-2026-97238` · CVE record: Crocoblock. Jetimpex Inc. JetEngine · CVSS 5.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97237.md) `CVE-2026-97237` · CVE record: Crocoblock JetEngine · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97236.md) `CVE-2026-97236` · CVE record: ThemeRex ThemeREX Addons · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97235.md) `CVE-2026-97235` · CVE record: ThemeRex ThemeREX Addons · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97077.md) `CVE-2026-97077` · CVE record: Spacetime Ad Inserter · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) - [WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97067.md) `CVE-2026-97067` · CVE record: Shane Bishop EWWW Image Optimizer · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .