# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter](https://agentprime.io/advisories/CVE-2026-110847.md)
  `CVE-2026-110847` · CVE record: n8n-io n8n · CVSS 7.0 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FileRise: Unsanitized footerHtml in Public Site Config](https://agentprime.io/advisories/CVE-2026-69194.md)
  `CVE-2026-69194` · CVE record: error311 FileRise · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability](https://agentprime.io/advisories/CVE-2026-0316.md)
  `CVE-2026-0316` · CVE record: Palo Alto Networks Cloud NGFW and 2 more · CVSS 1.1 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Markdown Preview Enhanced: Stored XSS via Unsanitized \`.crossnote/head.html\` Injection in Webview](https://agentprime.io/advisories/CVE-2026-54701.md)
  `CVE-2026-54701` · CVE record: shd101wyy vscode-markdown-preview-enhanced · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-102755.md)
  `CVE-2026-102755` · CVE record: dataease dataease · CVSS 5.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-102756.md)
  `CVE-2026-102756` · CVE record: dataease dataease · CVSS 5.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies](https://agentprime.io/advisories/CVE-2026-103974.md)
  `CVE-2026-103974` · CVE record: lichess-org lila · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108484.md)
  `CVE-2026-108484` · CVE record: WPManageNinja Best Payments Plugin for WP · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108483.md)
  `CVE-2026-108483` · CVE record: hippooo Hippoo Mobile App for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-105066.md)
  `CVE-2026-105066` · CVE record: SimplyRETS SimplyRETS Real Estate IDX · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.](https://agentprime.io/advisories/DRUPAL-CORE-2026-016.md)
  `DRUPAL-CORE-2026-016`, `CVE-2026-108514` · Packagist `drupal/core`: affected `>=10.3.0, <10.6.19 || >=11.0.0, <11.3.19 || >=11.4.0, <11.4.10 || >=12.0.0-alpha1, <12.0.0-beta2`, fixed in `10.6.19`, `11.3.19`, `11.4.10`, `12.0.0-beta2` · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [The Drupal core Link module provides a field type that can be used for internal and external URLs.](https://agentprime.io/advisories/DRUPAL-CORE-2026-015.md)
  `DRUPAL-CORE-2026-015`, `CVE-2026-108515` · Packagist `drupal/core`: affected `>=8.9.0, <10.6.19 || >=11.0.0, <11.3.19 || >=11.4.0, <11.4.10 || >=12.0.0-alpha1, <12.0.0-beta2`, fixed in `10.6.19`, `11.3.19`, `11.4.10`, `12.0.0-beta2` · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Discourse: Stored oEmbed HTML injection via allowed iframe](https://agentprime.io/advisories/CVE-2026-91159.md)
  `CVE-2026-91159` · CVE record: discourse discourse · CVSS 7.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages](https://agentprime.io/advisories/CVE-2026-89069.md)
  `CVE-2026-89069` · CVE record: Progress MOVEit Transfer · CVSS 8.0 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Gitea Jupyter notebook UI redress through CSS class injection](https://agentprime.io/advisories/CVE-2026-60008.md)
  `CVE-2026-60008` · CVE record: Gitea Gitea · CVSS 3.5 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-1021
- [ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter](https://agentprime.io/advisories/CVE-2026-110627.md)
  `CVE-2026-110627` · CVE record: MacWarrior clipbucket-v5 · CVSS 2.1 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php](https://agentprime.io/advisories/CVE-2026-110626.md)
  `CVE-2026-110626` · CVE record: MacWarrior clipbucket-v5 · CVSS 5.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php](https://agentprime.io/advisories/CVE-2026-110625.md)
  `CVE-2026-110625` · CVE record: MacWarrior clipbucket-v5 · CVSS 5.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-107870.md)
  `CVE-2026-107870` · CVE record: Crocoblock JetEngine · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-107867.md)
  `CVE-2026-107867` · CVE record: Crocoblock JetProductTables · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-107422.md)
  `CVE-2026-107422` · CVE record: axew3.com WP w3all phpBB · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-105874.md)
  `CVE-2026-105874` · CVE record: Brainstorm Force SureCart · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored XSS Vulnerability in JTL-Shop](https://agentprime.io/advisories/CVE-2026-103904.md)
  `CVE-2026-103904` · CVE record: JTL-Software GmbH JTL-Shop · CVSS 8.6 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-107428.md)
  `CVE-2026-107428` · CVE record: VideoWhisper.com Paid Videochat Turnkey Site · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body](https://agentprime.io/advisories/CVE-2026-107757.md)
  `CVE-2026-107757` · CVE record: tigroumeow Gallery Custom Links · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title](https://agentprime.io/advisories/CVE-2026-107650.md)
  `CVE-2026-107650` · CVE record: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter](https://agentprime.io/advisories/CVE-2026-107631.md)
  `CVE-2026-107631` · CVE record: davidevalerio Record of Consent Extension for Complianz · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter](https://agentprime.io/advisories/CVE-2026-107751.md)
  `CVE-2026-107751` · CVE record: kitae-park Mang Board · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name](https://agentprime.io/advisories/CVE-2026-107756.md)
  `CVE-2026-107756` · CVE record: tigroumeow Meow Lightbox · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter](https://agentprime.io/advisories/CVE-2026-104761.md)
  `CVE-2026-104761` · CVE record: kitae-park Mang Board · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-9373.md)
  `CVE-2025-9373` · CVE record: peprodev PeproDev Branches Map (Mapify) · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title](https://agentprime.io/advisories/CVE-2026-107754.md)
  `CVE-2026-107754` · CVE record: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Tenant name tooltips can be used for XSS](https://agentprime.io/advisories/GHSA-9f9v-vm6w-3wx6.md)
  `GHSA-9f9v-vm6w-3wx6` · Packagist `filament/filament`: affected `>=3.0.0, <3.3.57 || >=4.0.0, <4.15.2 || >=5.0.0, <5.10.2`, fixed in `3.3.57`, `4.15.2`, `5.10.2` · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode](https://agentprime.io/advisories/CVE-2026-92409.md)
  `CVE-2026-92409` · CVE record: Unknown Donation Thermometer · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission](https://agentprime.io/advisories/CVE-2026-86799.md)
  `CVE-2026-86799` · CVE record: Unknown Forms · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link](https://agentprime.io/advisories/CVE-2026-86797.md)
  `CVE-2026-86797` · CVE record: Unknown Pricing Table · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter](https://agentprime.io/advisories/CVE-2026-107178.md)
  `CVE-2026-107178` · CVE record: Unknown Image Photo Gallery Final Tiles Grid · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header](https://agentprime.io/advisories/CVE-2026-107126.md)
  `CVE-2026-107126` · CVE record: Unknown WP Booking System · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon](https://agentprime.io/advisories/CVE-2026-106469.md)
  `CVE-2026-106469` · CVE record: Unknown Gutenverse Form · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-105261.md)
  `CVE-2026-105261` · CVE record: Unknown Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update](https://agentprime.io/advisories/CVE-2026-104644.md)
  `CVE-2026-104644` · CVE record: Unknown Image Photo Gallery Final Tiles Grid · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX](https://agentprime.io/advisories/CVE-2026-103369.md)
  `CVE-2026-103369` · CVE record: joaoromao Social Share Buttons & Analytics Plugin – GetSocial.io · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String](https://agentprime.io/advisories/CVE-2026-101924.md)
  `CVE-2026-101924` · CVE record: ice00 NewStatPress · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)](https://agentprime.io/advisories/CVE-2026-100153.md)
  `CVE-2026-100153` · CVE record: ice00 NewStatPress · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-97398.md)
  `CVE-2026-97398` · CVE record: foliovision FV Flowplayer Video Player · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field](https://agentprime.io/advisories/CVE-2026-100185.md)
  `CVE-2026-100185` · CVE record: wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values](https://agentprime.io/advisories/CVE-2026-83592.md)
  `CVE-2026-83592` · CVE record: doctorwp Contact Form DB for Enfold · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter](https://agentprime.io/advisories/CVE-2026-95816.md)
  `CVE-2026-95816` · CVE record: edgarrojas Smart Forms – when you need more than just a contact form · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)](https://agentprime.io/advisories/CVE-2026-94377.md)
  `CVE-2026-94377` · CVE record: avisverifies Verified Reviews (Avis Vérifiés) · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter](https://agentprime.io/advisories/CVE-2026-97020.md)
  `CVE-2026-97020` · CVE record: dougwollison PO/MO Editor · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter](https://agentprime.io/advisories/CVE-2026-93885.md)
  `CVE-2026-93885` · CVE record: blackworks1 Cryptocurrency Donation Box – Bitcoin & Crypto Donations · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-77114.md)
  `CVE-2026-77114` · CVE record: danrossiter Document Gallery · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-16495.md)
  `CVE-2026-16495` · CVE record: wpdevart Countdown Timer – Widget Countdown · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter](https://agentprime.io/advisories/CVE-2026-100193.md)
  `CVE-2026-100193` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.7 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-95807.md)
  `CVE-2026-95807` · CVE record: foliovision FV Player 8 · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter](https://agentprime.io/advisories/CVE-2026-103422.md)
  `CVE-2026-103422` · CVE record: ateshabaev AnyComment · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-103425.md)
  `CVE-2026-103425` · CVE record: masaakitanaka Booking Package · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-qjpx-jqm5-h2c4.md)
  `GHSA-qjpx-jqm5-h2c4`, `CVE-2026-96230` · NuGet `Microsoft.AspNetCore.Components.WebAssembly.Server`: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2`, fixed in `8.0.32`, `9.0.21`, `10.0.13`, `11.0.0-rc.2` · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Omnispace Agora Project < 26.10.0 Stored XSS via Category Description](https://agentprime.io/advisories/CVE-2026-63171.md)
  `CVE-2026-63171` · CVE record: Omnispace Agora Project · CVSS 5.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe](https://agentprime.io/advisories/CVE-2026-63169.md)
  `CVE-2026-63169` · CVE record: Omnispace Agora Project · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTEzVDIwOjAzOjIyLjE2NzAwMFoiLCJDVkUtMjAyNi02MzE2OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTE0VDIyOjUyOjI0Ljg3NjAwMFoiLCJDVkUtMjAyNi0xMTA4NDkiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTE0VDIyOjUyOjI0Ljg3NjAwMFoiLCJDVkUtMjAyNi0xMTA4NDkiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.