# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [unstructured: Stored XSS via unescaped HTML generation](https://agentprime.io/advisories/GHSA-v5mq-3xhg-98m9.md)
  `GHSA-v5mq-3xhg-98m9`, `CVE-2026-104250` · PyPI `unstructured`: affected `<0.24.1`, fixed in `0.24.1` · CVSS 6.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter](https://agentprime.io/advisories/CVE-2026-111168.md)
  `CVE-2026-111168` · CVE record: abhinavxd libredesk · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information](https://agentprime.io/advisories/CVE-2026-110878.md)
  `CVE-2026-110878` · CVE record: aureuserp aureuserp · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php](https://agentprime.io/advisories/CVE-2026-111233.md)
  `CVE-2026-111233` · CVE record: Netgate pfSense CE · CVSS 2.3 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color](https://agentprime.io/advisories/CVE-2026-111232.md)
  `CVE-2026-111232` · CVE record: Netgate pfSense CE · CVSS 4.8 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)](https://agentprime.io/advisories/CVE-2026-109131.md)
  `CVE-2026-109131` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode](https://agentprime.io/advisories/CVE-2026-104828.md)
  `CVE-2026-104828` · CVE record: HtmlUnit htmlunit-neko · CVSS 7.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GYM One admin user list is vulnerable to stored cross-site scripting](https://agentprime.io/advisories/CVE-2026-55872.md)
  `CVE-2026-55872` · CVE record: mayerbalintdev GYM-One · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-109893.md)
  `CVE-2026-109893` · CVE record: Brainstorm Force Presto Player · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-110375.md)
  `CVE-2026-110375` · CVE record: WP Chill Download Monitor · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-106604.md)
  `CVE-2026-106604` · CVE record: YITH YITH WooCommerce Compare · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108175.md)
  `CVE-2026-108175` · CVE record: PluginUs.Net MDTF · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-110890.md)
  `CVE-2026-110890` · CVE record: Crocoblock JetSmartFilters · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts](https://agentprime.io/advisories/CVE-2026-55876.md)
  `CVE-2026-55876` · CVE record: HeliumEdu platform · CVSS 3.5 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-105065.md)
  `CVE-2026-105065` · CVE record: 8theme.com XStore · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)](https://agentprime.io/advisories/CVE-2026-57568.md)
  `CVE-2026-57568` · CVE record: LycheeOrg Lychee · CVSS 5.7 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI](https://agentprime.io/advisories/CVE-2026-97667.md)
  `CVE-2026-97667` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2026-111096.md)
  `CVE-2026-111096` · CVE record: JetBrains TeamCity · CVSS 6.7 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2026-111095.md)
  `CVE-2026-111095` · CVE record: JetBrains TeamCity · CVSS 8.0 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views](https://agentprime.io/advisories/CVE-2026-58390.md)
  `CVE-2026-58390` · CVE record: opnsense core · CVSS 8.0 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [OPNsense: Stored XSS in Administration Settings via Certificate Description](https://agentprime.io/advisories/CVE-2026-58394.md)
  `CVE-2026-58394` · CVE record: opnsense core · CVSS 5.2 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [OPNsense: Stored XSS in Services: NTP GPS](https://agentprime.io/advisories/CVE-2026-58392.md)
  `CVE-2026-58392` · CVE record: opnsense core · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout](https://agentprime.io/advisories/CVE-2026-58391.md)
  `CVE-2026-58391` · CVE record: opnsense core · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received](https://agentprime.io/advisories/CVE-2026-59994.md)
  `CVE-2026-59994` · CVE record: espocrm espocrm · CVSS 4.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled](https://agentprime.io/advisories/CVE-2026-55184.md)
  `CVE-2026-55184` · CVE record: espocrm espocrm · CVSS 3.5 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user](https://agentprime.io/advisories/CVE-2026-53575.md)
  `CVE-2026-53575` · CVE record: espocrm espocrm · CVSS 2.7 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar](https://agentprime.io/advisories/CVE-2026-106153.md)
  `CVE-2026-106153` · CVE record: Progress Software Kendo UI for jQuery · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery](https://agentprime.io/advisories/CVE-2026-106151.md)
  `CVE-2026-106151` · CVE record: Progress Software Kendo UI for jQuery · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip](https://agentprime.io/advisories/CVE-2026-106150.md)
  `CVE-2026-106150` · CVE record: Progress Software Kendo UI for jQuery · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) in Kendo UI for jQuery Menu](https://agentprime.io/advisories/CVE-2026-106149.md)
  `CVE-2026-106149` · CVE record: Progress Software Kendo UI for jQuery · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery](https://agentprime.io/advisories/CVE-2026-106148.md)
  `CVE-2026-106148` · CVE record: Progress Software Kendo UI for jQuery · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery](https://agentprime.io/advisories/CVE-2026-106147.md)
  `CVE-2026-106147` · CVE record: Progress Software Kendo UI for jQuery · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery](https://agentprime.io/advisories/CVE-2026-106161.md)
  `CVE-2026-106161` · CVE record: Progress Software Kendo UI for jQuery · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery](https://agentprime.io/advisories/CVE-2026-106159.md)
  `CVE-2026-106159` · CVE record: Progress Software Kendo UI for jQuery · CVSS 4.7 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery](https://agentprime.io/advisories/CVE-2026-106158.md)
  `CVE-2026-106158` · CVE record: Progress Software Kendo UI for jQuery · CVSS 4.7 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery](https://agentprime.io/advisories/CVE-2026-106157.md)
  `CVE-2026-106157` · CVE record: Progress Software Kendo UI for jQuery · CVSS 4.7 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery](https://agentprime.io/advisories/CVE-2026-106162.md)
  `CVE-2026-106162` · CVE record: Progress Software Kendo UI for jQuery · CVSS 4.7 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser](https://agentprime.io/advisories/CVE-2026-106163.md)
  `CVE-2026-106163` · CVE record: Progress Software Kendo UI for jQuery · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-109685.md)
  `CVE-2026-109685` · CVE record: Link Whisper INC Link Whisper Free · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-105882.md)
  `CVE-2026-105882` · CVE record: ThemeGrill User Registration · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-109702.md)
  `CVE-2026-109702` · CVE record: maxfoundry Social Share Buttons · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108491.md)
  `CVE-2026-108491` · CVE record: Everest Forms Everest Forms · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108498.md)
  `CVE-2026-108498` · CVE record: bannersky BSK PDF Manager · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Privilege Escalation via QuFTP Log-based XSS](https://agentprime.io/advisories/CVE-2026-47790.md)
  `CVE-2026-47790` · CVE record: QNAP Systems Inc. QuFTP Service · CVSS 6.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) in Note Station file upload functionality](https://agentprime.io/advisories/CVE-2026-39991.md)
  `CVE-2026-39991` · CVE record: QNAP Systems Inc. Notes Station 3 · CVSS 4.8 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored XSS via Interface Name in Network & Virtual Switch App](https://agentprime.io/advisories/CVE-2026-22896.md)
  `CVE-2026-22896` · CVE record: QNAP Systems Inc. Network & Virtual Switch · CVSS 6.2 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute](https://agentprime.io/advisories/CVE-2026-74920.md)
  `CVE-2026-74920` · CVE record: Unknown Document Gallery · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature](https://agentprime.io/advisories/CVE-2026-78087.md)
  `CVE-2026-78087` · CVE record: vektor-inc VK Blocks · CVSS 6.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'](https://agentprime.io/advisories/CVE-2026-15180.md)
  `CVE-2026-15180` · CVE record: data443 Tracking Code Manager · CVSS 6.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter](https://agentprime.io/advisories/CVE-2026-88043.md)
  `CVE-2026-88043` · CVE record: kitae-park Mang Board · CVSS 7.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter](https://agentprime.io/advisories/CVE-2026-18557.md)
  `CVE-2026-18557` · CVE record: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery · CVSS 6.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter](https://agentprime.io/advisories/CVE-2026-18548.md)
  `CVE-2026-18548` · CVE record: trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation · CVSS 7.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'](https://agentprime.io/advisories/CVE-2026-18586.md)
  `CVE-2026-18586` · CVE record: codename065 Premium Packages – Sell Digital Products Securely · CVSS 7.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields](https://agentprime.io/advisories/CVE-2026-17001.md)
  `CVE-2026-17001` · CVE record: carazo Import and export users and customers · CVSS 6.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute](https://agentprime.io/advisories/CVE-2026-78001.md)
  `CVE-2026-78001` · CVE record: boldgrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor · CVSS 6.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content](https://agentprime.io/advisories/CVE-2026-14572.md)
  `CVE-2026-14572` · CVE record: themeum Kirki – Freeform Page Builder, Website Builder & Customizer · CVSS 6.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog).](https://agentprime.io/advisories/CVE-2026-106707.md)
  `CVE-2026-106707` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor.](https://agentprime.io/advisories/CVE-2026-106706.md)
  `CVE-2026-106706` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue.](https://agentprime.io/advisories/CVE-2026-106701.md)
  `CVE-2026-106701` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview](https://agentprime.io/advisories/CVE-2026-110849.md)
  `CVE-2026-110849` · CVE record: n8n-io n8n · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTE0VDIyOjUyOjI0Ljg3NjAwMFoiLCJDVkUtMjAyNi0xMTA4NDkiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTE1VDIwOjE2OjI5LjAwMDAwMFoiLCJHSFNBLXY3NXYtNmZwZi1ndnc4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTE1VDIwOjE2OjI5LjAwMDAwMFoiLCJHSFNBLXY3NXYtNmZwZi1ndnc4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.