# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters](https://agentprime.io/advisories/CVE-2026-109208.md)
  `CVE-2026-109208` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 7.2 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter](https://agentprime.io/advisories/CVE-2026-111601.md)
  `CVE-2026-111601` · CVE record: hippooo Hippoo Mobile App for WooCommerce · CVSS 6.1 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS)
- [tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch](https://agentprime.io/advisories/CVE-2026-111713.md)
  `CVE-2026-111713` · CVE record: AmauriC tarteaucitron.js · CVSS 5.1 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context](https://agentprime.io/advisories/CVE-2026-44977.md)
  `CVE-2026-44977` · CVE record: Countly countly-server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller](https://agentprime.io/advisories/CVE-2026-90821.md)
  `CVE-2026-90821` · CVE record: Arcadia Technology, LLC Crafty Controller · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role](https://agentprime.io/advisories/CVE-2026-97470.md)
  `CVE-2026-97470` · CVE record: themefic Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-111400.md)
  `CVE-2026-111400` · CVE record: IdeaBox Creations PowerPack Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-110903.md)
  `CVE-2026-110903` · CVE record: Liquid Web / StellarWP The Events Calendar · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-111405.md)
  `CVE-2026-111405` · CVE record: PT Norther Lights Production MapSVG · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter](https://agentprime.io/advisories/CVE-2026-107648.md)
  `CVE-2026-107648` · CVE record: switcorp WP Sessions Time Monitoring Full Automatic · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event\[location_name\]' Parameter](https://agentprime.io/advisories/CVE-2026-107649.md)
  `CVE-2026-107649` · CVE record: liedekef Events Made Easy · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute](https://agentprime.io/advisories/CVE-2026-110703.md)
  `CVE-2026-110703` · CVE record: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body](https://agentprime.io/advisories/CVE-2026-96768.md)
  `CVE-2026-96768` · CVE record: softaculous GoSMTP Pro · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-104726.md)
  `CVE-2026-104726` · CVE record: jeroenpeters1986 Name Directory · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment](https://agentprime.io/advisories/CVE-2026-109224.md)
  `CVE-2026-109224` · CVE record: surecart SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter](https://agentprime.io/advisories/CVE-2026-93681.md)
  `CVE-2026-93681` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter](https://agentprime.io/advisories/CVE-2026-96870.md)
  `CVE-2026-96870` · CVE record: brainstormforce SureDash – Community, Courses & Member Dashboard · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting](https://agentprime.io/advisories/CVE-2026-100108.md)
  `CVE-2026-100108` · CVE record: maxfoundry Social Share Buttons · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter](https://agentprime.io/advisories/CVE-2026-100106.md)
  `CVE-2026-100106` · CVE record: damian-gora FiboSearch – Ajax Search for WooCommerce · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header](https://agentprime.io/advisories/CVE-2026-87111.md)
  `CVE-2026-87111` · CVE record: WPEverest User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-96339.md)
  `CVE-2026-96339` · CVE record: Houzez.co Houzez · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)](https://agentprime.io/advisories/CVE-2026-97640.md)
  `CVE-2026-97640` · CVE record: smub WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import](https://agentprime.io/advisories/CVE-2026-110252.md)
  `CVE-2026-110252` · CVE record: etruel WPeMatico RSS Feed Fetcher · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value](https://agentprime.io/advisories/CVE-2026-109193.md)
  `CVE-2026-109193` · CVE record: hivepress HivePress – Business Directory, Listings & Classified Ads Plugin · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers](https://agentprime.io/advisories/CVE-2026-107768.md)
  `CVE-2026-107768` · CVE record: cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode](https://agentprime.io/advisories/CVE-2026-109388.md)
  `CVE-2026-109388` · CVE record: hivepress HivePress – Business Directory, Listings & Classified Ads Plugin · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute](https://agentprime.io/advisories/CVE-2026-110290.md)
  `CVE-2026-110290` · CVE record: ajay WebberZone Top 10 — Popular Posts · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field](https://agentprime.io/advisories/CVE-2026-111069.md)
  `CVE-2026-111069` · CVE record: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes](https://agentprime.io/advisories/CVE-2026-110664.md)
  `CVE-2026-110664` · CVE record: codename065 Premium Packages – Sell Digital Products Securely · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter](https://agentprime.io/advisories/CVE-2026-110701.md)
  `CVE-2026-110701` · CVE record: codepeople CP Multi View Events Calendar · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field](https://agentprime.io/advisories/CVE-2026-100186.md)
  `CVE-2026-100186` · CVE record: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter](https://agentprime.io/advisories/CVE-2026-88963.md)
  `CVE-2026-88963` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.1 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route](https://agentprime.io/advisories/CVE-2026-109513.md)
  `CVE-2026-109513` · CVE record: wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink](https://agentprime.io/advisories/CVE-2026-107764.md)
  `CVE-2026-107764` · CVE record: gpriday SiteOrigin CSS · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector](https://agentprime.io/advisories/CVE-2026-111122.md)
  `CVE-2026-111122` · CVE record: gpriday SiteOrigin CSS · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content](https://agentprime.io/advisories/CVE-2026-89051.md)
  `CVE-2026-89051` · CVE record: johndarrel Hide My WP Ghost – Security & Firewall · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX](https://agentprime.io/advisories/CVE-2026-109232.md)
  `CVE-2026-109232` · CVE record: wordpresschef Salon Booking System – Appointment Booking for Salons, Barbershops & Spas · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter](https://agentprime.io/advisories/CVE-2026-95809.md)
  `CVE-2026-95809` · CVE record: optiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter](https://agentprime.io/advisories/CVE-2026-95686.md)
  `CVE-2026-95686` · CVE record: optiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}](https://agentprime.io/advisories/CVE-2026-104000.md)
  `CVE-2026-104000` · CVE record: croixhaug Simply Schedule Appointments · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-103480.md)
  `CVE-2026-103480` · CVE record: themefic Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter](https://agentprime.io/advisories/CVE-2026-107748.md)
  `CVE-2026-107748` · CVE record: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload](https://agentprime.io/advisories/CVE-2026-103999.md)
  `CVE-2026-103999` · CVE record: themefic Ultra Addons for Contact Form 7 · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-110017.md)
  `CVE-2026-110017` · CVE record: fullworks Quick PayPal Payments: Payment Button & Form · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field](https://agentprime.io/advisories/CVE-2026-100158.md)
  `CVE-2026-100158` · CVE record: elvinhaci SQL Chart Builder · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter](https://agentprime.io/advisories/CVE-2026-96570.md)
  `CVE-2026-96570` · CVE record: magazine3 Schema & Structured Data for WP & AMP · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter](https://agentprime.io/advisories/CVE-2026-103481.md)
  `CVE-2026-103481` · CVE record: mpol Gwolle Guestbook · CVSS 6.1 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX](https://agentprime.io/advisories/CVE-2026-109998.md)
  `CVE-2026-109998` · CVE record: kitae-park Mang Board · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter](https://agentprime.io/advisories/CVE-2026-109512.md)
  `CVE-2026-109512` · CVE record: kitae-park Mang Board · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments](https://agentprime.io/advisories/CVE-2026-107758.md)
  `CVE-2026-107758` · CVE record: extendthemes Colibri Page Builder · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL](https://agentprime.io/advisories/CVE-2026-109207.md)
  `CVE-2026-109207` · CVE record: themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter](https://agentprime.io/advisories/CVE-2026-97339.md)
  `CVE-2026-97339` · CVE record: complianz Complianz GDPR/CCPA Cookie Consent Banner · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content](https://agentprime.io/advisories/CVE-2026-109990.md)
  `CVE-2026-109990` · CVE record: gijo Flying Scripts: Delay JavaScript to Improve Site Speed & Performance · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via \[cooked-timer\] Shortcode Content](https://agentprime.io/advisories/CVE-2026-77829.md)
  `CVE-2026-77829` · CVE record: goratech Cooked – Recipe Management · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-93535.md)
  `CVE-2026-93535` · CVE record: wppool Dark Mode – Improve Accessibility with AI Powered Dark Theme · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Backdrop](https://agentprime.io/advisories/CVE-2026-111442.md)
  `CVE-2026-111442` · CVE record: BackdropCMS Backdrop · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly int…](https://agentprime.io/advisories/CVE-2025-52097.md)
  `CVE-2025-52097` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal](https://agentprime.io/advisories/CVE-2026-111284.md)
  `CVE-2026-111284` · CVE record: Webkul Aureus ERP · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses](https://agentprime.io/advisories/GHSA-qx66-fv34-fjm8.md)
  `GHSA-qx66-fv34-fjm8`, `CVE-2026-102989` · npm `@tanstack/react-start` and 3 more: affected `>=1.143.12, <1.168.60`, fixed in `1.168.60` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Vitess vttablet /twopcz reflected XSS](https://agentprime.io/advisories/GHSA-v75v-6fpf-gvw8.md)
  `GHSA-v75v-6fpf-gvw8`, `CVE-2026-104252`, `GO-2026-6798` · Go `vitess.io/vitess`: affected `<0.23.5 || >=0.24.0, <0.24.2`, fixed in `0.23.5`, `0.24.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTE1VDIwOjE2OjI5LjAwMDAwMFoiLCJHSFNBLXY3NXYtNmZwZi1ndnc4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTE3VDAzOjQzOjI2LjY2MzAwMFoiLCJDVkUtMjAyNi0xMDk5ODUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTE3VDAzOjQzOjI2LjY2MzAwMFoiLCJDVkUtMjAyNi0xMDk5ODUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.