# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload](https://agentprime.io/advisories/CVE-2026-104475.md)
  `CVE-2026-104475` · CVE record: idurar idurar-erp-crm · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [@a2ui/web_core: \`openUrl\` permits \`javascript:\` URI execution via agent-supplied button actions](https://agentprime.io/advisories/GHSA-72qq-p3r5-f7wq.md)
  `GHSA-72qq-p3r5-f7wq`, `CVE-2026-10032` · npm `@a2ui/web_core`: affected `>=0.9.0, <0.10.2`, fixed in `0.10.2` · CVSS 6.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute](https://agentprime.io/advisories/CVE-2026-102626.md)
  `CVE-2026-102626` · CVE record: LimeSurvey LimeSurvey · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler](https://agentprime.io/advisories/CVE-2026-104907.md)
  `CVE-2026-104907` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output](https://agentprime.io/advisories/CVE-2026-104906.md)
  `CVE-2026-104906` · CVE record: MISP MISP · CVSS 6.2 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server](https://agentprime.io/advisories/CVE-2026-104901.md)
  `CVE-2026-104901` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index](https://agentprime.io/advisories/CVE-2026-104900.md)
  `CVE-2026-104900` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Reflected XSS in MRV Technology's TurkHotspot](https://agentprime.io/advisories/CVE-2026-5782.md)
  `CVE-2026-5782` · CVE record: MRV Technology Foreign Trade Ltd. Co. TurkHotspot · CVSS 5.2 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter](https://agentprime.io/advisories/CVE-2026-93875.md)
  `CVE-2026-93875` · CVE record: Crocoblock JetAppointment · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SourceCodester Student Result Management System Announcement new_announcement.php cross site scripting](https://agentprime.io/advisories/CVE-2026-104612.md)
  `CVE-2026-104612` · CVE record: SourceCodester Student Result Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102798.md)
  `CVE-2026-102798` · CVE record: ThemeREX Group ThemeREX Addons · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute](https://agentprime.io/advisories/CVE-2026-104466.md)
  `CVE-2026-104466` · CVE record: YesWiki yeswiki · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler](https://agentprime.io/advisories/CVE-2026-104465.md)
  `CVE-2026-104465` · CVE record: YesWiki yeswiki · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField](https://agentprime.io/advisories/CVE-2026-104461.md)
  `CVE-2026-104461` · CVE record: YesWiki yeswiki · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action](https://agentprime.io/advisories/CVE-2026-104450.md)
  `CVE-2026-104450` · CVE record: YesWiki yeswiki · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59668.md)
  `CVE-2026-59668` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59667.md)
  `CVE-2026-59667` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59666.md)
  `CVE-2026-59666` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59665.md)
  `CVE-2026-59665` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59662.md)
  `CVE-2026-59662` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59664.md)
  `CVE-2026-59664` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59663.md)
  `CVE-2026-59663` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-95662.md)
  `CVE-2026-95662` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59661.md)
  `CVE-2026-59661` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59660.md)
  `CVE-2026-59660` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59659.md)
  `CVE-2026-59659` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key](https://agentprime.io/advisories/CVE-2026-97652.md)
  `CVE-2026-97652` · CVE record: veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative · CVSS 6.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname](https://agentprime.io/advisories/CVE-2026-85492.md)
  `CVE-2026-85492` · CVE record: smub All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) · CVSS 6.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content](https://agentprime.io/advisories/CVE-2026-87920.md)
  `CVE-2026-87920` · CVE record: boldgrid W3 Total Cache · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59673.md)
  `CVE-2026-59673` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59672.md)
  `CVE-2026-59672` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59671.md)
  `CVE-2026-59671` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59670.md)
  `CVE-2026-59670` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in the Repasat application](https://agentprime.io/advisories/CVE-2026-59669.md)
  `CVE-2026-59669` · CVE record: Repasat Repasat application · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name](https://agentprime.io/advisories/CVE-2026-97338.md)
  `CVE-2026-97338` · CVE record: codename065 Download Manager · CVSS 6.4 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd\[remark\]' Parameter](https://agentprime.io/advisories/CVE-2026-96647.md)
  `CVE-2026-96647` · CVE record: webilia Listdom: AI-powered Business Directory with Classifieds Ads Listings · CVSS 6.4 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect](https://agentprime.io/advisories/CVE-2026-95670.md)
  `CVE-2026-95670` · CVE record: mihdan No External Links · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview](https://agentprime.io/advisories/CVE-2026-93756.md)
  `CVE-2026-93756` · CVE record: smub Smash Balloon Social Post Feed – Simple Social Feeds for WordPress · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)](https://agentprime.io/advisories/CVE-2026-100107.md)
  `CVE-2026-100107` · CVE record: extendthemes Kubio AI Page Builder · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter](https://agentprime.io/advisories/CVE-2026-96871.md)
  `CVE-2026-96871` · CVE record: kitae-park Mang Board · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action](https://agentprime.io/advisories/CVE-2026-97342.md)
  `CVE-2026-97342` · CVE record: jetmonsters JetFormBuilder — Dynamic Blocks Form Builder · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '\_rt' Parameter](https://agentprime.io/advisories/CVE-2026-103426.md)
  `CVE-2026-103426` · CVE record: Relevanssi Relevanssi Premium · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter](https://agentprime.io/advisories/CVE-2026-96566.md)
  `CVE-2026-96566` · CVE record: satollo Newsletter – Send awesome emails from WordPress · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor](https://agentprime.io/advisories/CVE-2026-100182.md)
  `CVE-2026-100182` · CVE record: wpchill Download Monitor · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content](https://agentprime.io/advisories/CVE-2026-97641.md)
  `CVE-2026-97641` · CVE record: comesio Relevanssi – A Better Search · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field](https://agentprime.io/advisories/CVE-2026-102772.md)
  `CVE-2026-102772` · CVE record: jtsternberg CMB2 · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content](https://agentprime.io/advisories/CVE-2026-95817.md)
  `CVE-2026-95817` · CVE record: apasionados DoFollow Case by Case · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type](https://agentprime.io/advisories/CVE-2026-97336.md)
  `CVE-2026-97336` · CVE record: jtsternberg CMB2 · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder](https://agentprime.io/advisories/CVE-2026-93880.md)
  `CVE-2026-93880` · CVE record: wpsoul Greenshift – animation and page builder blocks · CVSS 6.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)](https://agentprime.io/advisories/CVE-2026-96567.md)
  `CVE-2026-96567` · CVE record: websoudan MW WP Form · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content](https://agentprime.io/advisories/CVE-2026-96578.md)
  `CVE-2026-96578` · CVE record: creative-solutions-1 GSpeech TTS – WordPress Text To Speech Plugin · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name](https://agentprime.io/advisories/CVE-2026-97663.md)
  `CVE-2026-97663` · CVE record: ivole Customer Reviews for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection](https://agentprime.io/advisories/CVE-2026-1661.md)
  `CVE-2026-1661` · CVE record: Unknown WP Mail Logging · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter](https://agentprime.io/advisories/CVE-2026-102565.md)
  `CVE-2026-102565` · CVE record: bookingalgorithms BA Book Everything · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Webpros cPanel and others](https://agentprime.io/advisories/CVE-2026-93029.md)
  `CVE-2026-93029` · CVE record: Webpros cPanel and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Webpros cPanel and others](https://agentprime.io/advisories/CVE-2026-93697.md)
  `CVE-2026-93697` · CVE record: Webpros cPanel and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color](https://agentprime.io/advisories/CVE-2026-91022.md)
  `CVE-2026-91022` · CVE record: Unknown Motors · CVSS 6.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter](https://agentprime.io/advisories/CVE-2026-85016.md)
  `CVE-2026-85016` · CVE record: Unknown Unlimited Elements for Elementor · CVSS 6.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content](https://agentprime.io/advisories/CVE-2026-13718.md)
  `CVE-2026-13718` · CVE record: Unknown Tabs Responsive · CVSS 6.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name](https://agentprime.io/advisories/CVE-2026-78471.md)
  `CVE-2026-78471` · CVE record: optimizingmatters Autoptimize · CVSS 5.4 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTAyVDA1OjMwOjE4LjI1NzAwMFoiLCJDVkUtMjAyNi03ODQ3MSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTAyVDIzOjI4OjQ3LjQxNDAwMFoiLCJDVkUtMjAyNi0xMDQ0NzciXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTAyVDIzOjI4OjQ3LjQxNDAwMFoiLCJDVkUtMjAyNi0xMDQ0NzciXQ>. Everything for agents: <https://agentprime.io/llms.txt>.