# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update](https://agentprime.io/advisories/CVE-2026-103305.md)
  `CVE-2026-103305` · CVE record: Unknown Prenotazioni · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable](https://agentprime.io/advisories/CVE-2026-12980.md)
  `CVE-2026-12980` · CVE record: Unknown Post Snippets · CVSS 6.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-57742.md)
  `CVE-2026-57742` · CVE record: ThemeREX Group Kids Planet · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-78534.md)
  `CVE-2026-78534` · CVE record: Keen IT Solutions Educavo · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-78532.md)
  `CVE-2026-78532` · CVE record: designthemes LMS · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62116.md)
  `CVE-2026-62116` · CVE record: Dmitry V. Barcode Scanner with Inventory & Order Manager · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62100.md)
  `CVE-2026-62100` · CVE record: kutethemes KuteShop · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62095.md)
  `CVE-2026-62095` · CVE record: kutethemes Biolife · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62093.md)
  `CVE-2026-62093` · CVE record: kutethemes TechOne · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62091.md)
  `CVE-2026-62091` · CVE record: kutethemes Armania · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62082.md)
  `CVE-2026-62082` · CVE record: An-Themes Pin WP · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62064.md)
  `CVE-2026-62064` · CVE record: Bracketweb Ambed · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62037.md)
  `CVE-2026-62037` · CVE record: bPlugins Document Embedder · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62034.md)
  `CVE-2026-62034` · CVE record: bPlugins Before After Image Comparison – Image comparison for WP · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-62027.md)
  `CVE-2026-62027` · CVE record: bPlugins Team Section Block · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42715.md)
  `CVE-2026-42715` · CVE record: 10Web Photo Gallery by 10Web · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42711.md)
  `CVE-2026-42711` · CVE record: 10Web Slider by 10Web · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42709.md)
  `CVE-2026-42709` · CVE record: RadiusTheme Food Menu – Restaurant Menu & Online Ordering for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42702.md)
  `CVE-2026-42702` · CVE record: Themeum Tutor LMS · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42699.md)
  `CVE-2026-42699` · CVE record: FolioVision FV Player 8 · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42697.md)
  `CVE-2026-42697` · CVE record: Inisev Social Share Icons & Social Share Buttons · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42693.md)
  `CVE-2026-42693` · CVE record: TieLabs Jannah · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42632.md)
  `CVE-2026-42632` · CVE record: QODE Qode Real Estate · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42631.md)
  `CVE-2026-42631` · CVE record: QODE Qode Music · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-40803.md)
  `CVE-2026-40803` · CVE record: Jotform Jotform \&#8211; AI Chatbot · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-39800.md)
  `CVE-2026-39800` · CVE record: Anton Bond Additional Order Filters for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-39799.md)
  `CVE-2026-39799` · CVE record: Joomunited WP File Download · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-57806.md)
  `CVE-2026-57806` · CVE record: drfuri Martfury - WooCommerce Marketplace WordPress Theme · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94160.md)
  `CVE-2026-94160` · CVE record: themeStek ThemeStek Extras for LabtechCO Theme · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97264.md)
  `CVE-2026-97264` · CVE record: Greg Winiarski WPAdverts · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97263.md)
  `CVE-2026-97263` · CVE record: Greg Winiarski WPAdverts · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-102388.md)
  `CVE-2026-102388` · CVE record: WPMU DEV Forminator · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue](https://agentprime.io/advisories/CVE-2026-106139.md)
  `CVE-2026-106139` · CVE record: Progress Software Kendo UI for Vue · CVSS 5.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting via Chart Tooltip in KendoReact](https://agentprime.io/advisories/CVE-2026-106138.md)
  `CVE-2026-106138` · CVE record: Progress Software KendoReact · CVSS 5.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form](https://agentprime.io/advisories/CVE-2026-107657.md)
  `CVE-2026-107657` · CVE record: hivepress HivePress – Business Directory, Listings & Classified Ads Plugin · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute](https://agentprime.io/advisories/CVE-2026-4791.md)
  `CVE-2026-4791` · CVE record: peprodev PeproDev Ultimate Profile Solutions · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-93951.md)
  `CVE-2026-93951` · CVE record: Bracketweb Zeinet · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout\[billing\]\[phone\]' Parameter](https://agentprime.io/advisories/CVE-2026-103478.md)
  `CVE-2026-103478` · CVE record: codename065 Premium Packages – Sell Digital Products Securely · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field](https://agentprime.io/advisories/CVE-2026-97340.md)
  `CVE-2026-97340` · CVE record: ThemeFusion Avada | Website Builder For WordPress & WooCommerce · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content](https://agentprime.io/advisories/CVE-2026-102774.md)
  `CVE-2026-102774` · CVE record: brainstormforce SureDash – Community, Courses & Member Dashboard · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter](https://agentprime.io/advisories/CVE-2026-100178.md)
  `CVE-2026-100178` · CVE record: gwin WPAdverts – Classifieds Plugin · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)](https://agentprime.io/advisories/CVE-2026-96765.md)
  `CVE-2026-96765` · CVE record: wpo365 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint](https://agentprime.io/advisories/CVE-2026-97396.md)
  `CVE-2026-97396` · CVE record: retainful Email Marketing for WordPress and WooCommerce – Retainful · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute](https://agentprime.io/advisories/CVE-2026-101921.md)
  `CVE-2026-101921` · CVE record: smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More · CVSS 4.7 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute](https://agentprime.io/advisories/CVE-2026-101920.md)
  `CVE-2026-101920` · CVE record: molongui Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)](https://agentprime.io/advisories/CVE-2026-100147.md)
  `CVE-2026-100147` · CVE record: teamfunnelkit FunnelKit – Funnel Builder for WooCommerce Checkout · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter](https://agentprime.io/advisories/CVE-2026-96563.md)
  `CVE-2026-96563` · CVE record: stylemix Motors – Car Dealership & Classified Listings Plugin · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History](https://agentprime.io/advisories/CVE-2026-96278.md)
  `CVE-2026-96278` · CVE record: opajaap WP Photo Album Plus · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field](https://agentprime.io/advisories/CVE-2026-103427.md)
  `CVE-2026-103427` · CVE record: wpinsider-1 Simple Membership · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name](https://agentprime.io/advisories/CVE-2026-96572.md)
  `CVE-2026-96572` · CVE record: aguidrevitch WP Meteor Website Speed Optimization Addon · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name](https://agentprime.io/advisories/CVE-2026-107742.md)
  `CVE-2026-107742` · CVE record: 10web 10Web Booster – Website speed optimization, Cache & Page Speed optimizer · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content](https://agentprime.io/advisories/CVE-2026-100196.md)
  `CVE-2026-100196` · CVE record: wp_media LazyLoad Plugin – Lazy Load Images, Videos, and Iframes · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via \[tlpteam\] Shortcode](https://agentprime.io/advisories/CVE-2026-102402.md)
  `CVE-2026-102402` · CVE record: techlabpro1 Team – Team Members Showcase Plugin · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content](https://agentprime.io/advisories/CVE-2026-6243.md)
  `CVE-2026-6243` · CVE record: shabti Frontend Admin by DynamiApps · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt\_' prefix](https://agentprime.io/advisories/CVE-2026-5725.md)
  `CVE-2026-5725` · CVE record: archetyped Favicon Rotator · CVSS 6.1 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter](https://agentprime.io/advisories/CVE-2026-100161.md)
  `CVE-2026-100161` · CVE record: villatheme Photo Reviews for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute](https://agentprime.io/advisories/CVE-2026-103897.md)
  `CVE-2026-103897` · CVE record: dfactory Responsive Lightbox & Gallery · CVSS 4.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment](https://agentprime.io/advisories/CVE-2026-89100.md)
  `CVE-2026-89100` · CVE record: paymentplugins Payment Plugins for Stripe WooCommerce · CVSS 6.1 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments\[name\]' Parameter](https://agentprime.io/advisories/CVE-2026-95684.md)
  `CVE-2026-95684` · CVE record: e4jvikwp VikBooking Hotel Booking Engine & PMS · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field](https://agentprime.io/advisories/CVE-2026-96840.md)
  `CVE-2026-96840` · CVE record: wpxpo Post Grid Gutenberg Blocks – PostX · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTEwVDA2OjQwOjA5LjQ0MjAwMFoiLCJDVkUtMjAyNi05Njg0MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTExVDA2OjAwOjEwLjQ2NjAwMFoiLCJDVkUtMjAyNi04MTE1MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTExVDA2OjAwOjEwLjQ2NjAwMFoiLCJDVkUtMjAyNi04MTE1MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.