# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission](https://agentprime.io/advisories/CVE-2026-90438.md)
  `CVE-2026-90438` · CVE record: kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter](https://agentprime.io/advisories/CVE-2026-84925.md)
  `CVE-2026-84925` · CVE record: ThemeFusion Avada | Website Builder For WordPress & WooCommerce · CVSS 6.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)](https://agentprime.io/advisories/CVE-2026-93367.md)
  `CVE-2026-93367` · CVE record: wp-buy Visitor Traffic Real Time Statistics pro · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in CWE-79 - Cross-site Scripting CAPEC-63](https://agentprime.io/advisories/CVE-2026-71454.md)
  `CVE-2026-71454` · CVE record: CWE-79 - Cross-site Scripting CAPEC-63 · CVSS 5.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php](https://agentprime.io/advisories/CVE-2026-71542.md)
  `CVE-2026-71542` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 8.7 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content](https://agentprime.io/advisories/CVE-2026-70650.md)
  `CVE-2026-70650` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character](https://agentprime.io/advisories/CVE-2026-55230.md)
  `CVE-2026-55230` · CVE record: givanz Vvveb · CVSS 8.7 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard](https://agentprime.io/advisories/GHSA-6966-vjj6-99xv.md)
  `GHSA-6966-vjj6-99xv`, `CVE-2026-102831`, `PYSEC-2026-4057`, `PYSEC-2026-4058`, `PYSEC-2026-4060`, `PYSEC-2026-4112` · PyPI `notebook`: affected `>=7.5.0, <7.6.3`, fixed in `7.6.3` · CVSS 8.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-345
- [Prime Mover < 2.2.1 Stored XSS via Package Metadata](https://agentprime.io/advisories/CVE-2026-101890.md)
  `CVE-2026-101890` · CVE record: Codexonics Prime Mover · CVSS 5.1 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)](https://agentprime.io/advisories/GHSA-3jqq-pw4j-pqcj.md)
  `GHSA-3jqq-pw4j-pqcj`, `CVE-2026-102830`, `PYSEC-2026-4056`, `PYSEC-2026-4059` · PyPI `jupyterlab` and 1 more: affected `>=3.0.0, <4.5.11 || >=4.6.0, <4.6.4`, fixed in `4.5.11`, `4.6.4` · CVSS 6.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-625
- [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-56589.md)
  `CVE-2026-56589` · CVE record: HCL Software HCL BigFix Service Management · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102378.md)
  `CVE-2026-102378` · CVE record: bPlugins Parallax Section block · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97273.md)
  `CVE-2026-97273` · CVE record: Premmerce Premmerce Wishlist for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97268.md)
  `CVE-2026-97268` · CVE record: Premmerce Premmerce Wishlist for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97260.md)
  `CVE-2026-97260` · CVE record: maxfoundry MaxGalleria · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting](https://agentprime.io/advisories/CVE-2026-103686.md)
  `CVE-2026-103686` · CVE record: rhukster dom-sanitizer · CVSS 5.1 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102394.md)
  `CVE-2026-102394` · CVE record: WPDeveloper Essential Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-103339.md)
  `CVE-2026-103339` · CVE record: Wpmet Metform · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-103063.md)
  `CVE-2026-103063` · CVE record: Wpmet ElementsKit Elementor addons Lite · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-103064.md)
  `CVE-2026-103064` · CVE record: Wpmet ElementsKit Elementor addons Lite · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-103343.md)
  `CVE-2026-103343` · CVE record: WP ManageNinja LLC FluentForm · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head](https://agentprime.io/advisories/CVE-2026-103292.md)
  `CVE-2026-103292` · CVE record: TryGhost Ghost · CVSS 8.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed](https://agentprime.io/advisories/CVE-2026-103277.md)
  `CVE-2026-103277` · CVE record: TryGhost Ghost · CVSS 8.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator](https://agentprime.io/advisories/CVE-2026-103249.md)
  `CVE-2026-103249` · CVE record: n8n-io n8n · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in Entradium by Crocantickets](https://agentprime.io/advisories/CVE-2026-7176.md)
  `CVE-2026-7176` · CVE record: Crocantickets Entradium · CVSS 4.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in Entradium by Crocantickets](https://agentprime.io/advisories/CVE-2026-7175.md)
  `CVE-2026-7175` · CVE record: Crocantickets Entradium · CVSS 4.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in Entradium by Crocantickets](https://agentprime.io/advisories/CVE-2026-7174.md)
  `CVE-2026-7174` · CVE record: Crocantickets Entradium · CVSS 4.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in Entradium by Crocantickets](https://agentprime.io/advisories/CVE-2026-7173.md)
  `CVE-2026-7173` · CVE record: Crocantickets Entradium · CVSS 4.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting via Directory Name in File Manager Create Directory](https://agentprime.io/advisories/CVE-2026-64950.md)
  `CVE-2026-64950` · CVE record: Pandora FMS Pandora FMS · CVSS 8.4 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1\[post-custom\]' Parameter](https://agentprime.io/advisories/CVE-2026-92144.md)
  `CVE-2026-92144` · CVE record: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute](https://agentprime.io/advisories/CVE-2026-96256.md)
  `CVE-2026-96256` · CVE record: wpdevteam Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns · CVSS 6.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager](https://agentprime.io/advisories/CVE-2026-64946.md)
  `CVE-2026-64946` · CVE record: Pandora FMS Pandora FMS · CVSS 7.4 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF)
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103493.md)
  `CVE-2026-103493` · CVE record: JetBrains YouTrack · CVSS 8.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103489.md)
  `CVE-2026-103489` · CVE record: JetBrains YouTrack · CVSS 2.0 Low · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter](https://agentprime.io/advisories/CVE-2026-103664.md)
  `CVE-2026-103664` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MISP Reflected XSS in Taxonomy Tag Confirmation Forms](https://agentprime.io/advisories/CVE-2026-103662.md)
  `CVE-2026-103662` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field](https://agentprime.io/advisories/CVE-2026-97661.md)
  `CVE-2026-97661` · CVE record: scottpaterson Business Essentials for Contact Form 7 · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter](https://agentprime.io/advisories/CVE-2026-89424.md)
  `CVE-2026-89424` · CVE record: inisev Duplicate Post · CVSS 6.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter](https://agentprime.io/advisories/CVE-2026-89427.md)
  `CVE-2026-89427` · CVE record: spacetime Ad Inserter – Ad Manager & AdSense Ads · CVSS 6.1 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields](https://agentprime.io/advisories/CVE-2026-96813.md)
  `CVE-2026-96813` · CVE record: 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value](https://agentprime.io/advisories/CVE-2026-100184.md)
  `CVE-2026-100184` · CVE record: codepeople Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More · CVSS 4.7 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action](https://agentprime.io/advisories/CVE-2026-96268.md)
  `CVE-2026-96268` · CVE record: awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin · CVSS 6.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name](https://agentprime.io/advisories/CVE-2026-101925.md)
  `CVE-2026-101925` · CVE record: robin-w bbp style pack · CVSS 6.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer](https://agentprime.io/advisories/CVE-2026-96573.md)
  `CVE-2026-96573` · CVE record: codepeople Appointment Hour Booking – Booking Calendar · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field](https://agentprime.io/advisories/CVE-2026-85235.md)
  `CVE-2026-85235` · CVE record: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields](https://agentprime.io/advisories/CVE-2026-92244.md)
  `CVE-2026-92244` · CVE record: wpovernight PDF Invoices & Packing Slips for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field](https://agentprime.io/advisories/CVE-2026-90992.md)
  `CVE-2026-90992` · CVE record: davidanderson Redux Framework · CVSS 6.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()](https://agentprime.io/advisories/CVE-2026-100179.md)
  `CVE-2026-100179` · CVE record: codepeople Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More · CVSS 6.1 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path](https://agentprime.io/advisories/CVE-2026-14995.md)
  `CVE-2026-14995` · CVE record: optimizingmatters Autoptimize · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)](https://agentprime.io/advisories/CVE-2026-19902.md)
  `CVE-2026-19902` · CVE record: spacetime Ad Inserter – Ad Manager & AdSense Ads · CVSS 6.1 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL](https://agentprime.io/advisories/CVE-2026-89047.md)
  `CVE-2026-89047` · CVE record: inisev Social Media Share Buttons & Social Sharing Icons · CVSS 6.1 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Five Star Restaurant Reviews < 2.3.14 - Reflected XSS](https://agentprime.io/advisories/CVE-2026-92412.md)
  `CVE-2026-92412` · CVE record: Unknown Five Star Restaurant Reviews · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name](https://agentprime.io/advisories/CVE-2026-87973.md)
  `CVE-2026-87973` · CVE record: Unknown If-So Dynamic Content · CVSS 3.1 Low · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes](https://agentprime.io/advisories/CVE-2026-87970.md)
  `CVE-2026-87970` · CVE record: Unknown If-So Dynamic Content · CVSS 4.7 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon](https://agentprime.io/advisories/CVE-2026-86610.md)
  `CVE-2026-86610` · CVE record: Unknown Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback](https://agentprime.io/advisories/CVE-2026-81739.md)
  `CVE-2026-81739` · CVE record: Unknown Paytm Payment Gateway · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key](https://agentprime.io/advisories/CVE-2026-85679.md)
  `CVE-2026-85679` · CVE record: extendify Extendify · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [HCL Digital Experience is affected by improper input sanitation](https://agentprime.io/advisories/CVE-2026-67075.md)
  `CVE-2026-67075` · CVE record: HCLSoftware Digital Experience · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-12241.md)
  `CVE-2026-12241` · CVE record: mihail-barinov Advanced Woo Labels – Product Labels & Badges for WooCommerce · CVSS 5.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model\_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection](https://agentprime.io/advisories/CVE-2026-96561.md)
  `CVE-2026-96561` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTAxVDAzOjI4OjIyLjQ2NTAwMFoiLCJDVkUtMjAyNi05NjU2MSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTAyVDA1OjMwOjE4LjI1NzAwMFoiLCJDVkUtMjAyNi03ODQ3MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTAyVDA1OjMwOjE4LjI1NzAwMFoiLCJDVkUtMjAyNi03ODQ3MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.