# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [DB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-27895.md) `CVE-2025-27895` · CVE record: IBM DB2 Recovery Expert for Linux, UNIX and Windows · CVSS 6.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-27896.md) `CVE-2025-27896` · CVE record: IBM DB2 Recovery Expert for Linux, UNIX and Windows · CVSS 6.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-27897.md) `CVE-2025-27897` · CVE record: IBM DB2 Recovery Expert for Linux, UNIX and Windows · CVSS 6.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting](https://agentprime.io/advisories/CVE-2026-108920.md) `CVE-2026-108920` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Drug Recommendation System Student Registration add_student.php cross site scripting](https://agentprime.io/advisories/CVE-2026-108919.md) `CVE-2026-108919` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108482.md) `CVE-2026-108482` · CVE record: LeapWorx Premium Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-107862.md) `CVE-2026-107862` · CVE record: ExpressTech Quiz And Survey Master · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108478.md) `CVE-2026-108478` · CVE record: BdThemes Element Pack Elementor Addons · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Progress MarkLogic Server](https://agentprime.io/advisories/CVE-2026-85967.md) `CVE-2026-85967` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 6.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting](https://agentprime.io/advisories/CVE-2026-108908.md) `CVE-2026-108908` · CVE record: Netcore NR268 · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List](https://agentprime.io/advisories/CVE-2026-109355.md) `CVE-2026-109355` · CVE record: librenms librenms · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [LibreNMS before 26.9.0 Stored XSS via wireless sensor description](https://agentprime.io/advisories/CVE-2026-109352.md) `CVE-2026-109352` · CVE record: librenms librenms · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name](https://agentprime.io/advisories/CVE-2026-109328.md) `CVE-2026-109328` · CVE record: Admidio admidio · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php](https://agentprime.io/advisories/CVE-2026-109327.md) `CVE-2026-109327` · CVE record: Admidio admidio · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views](https://agentprime.io/advisories/CVE-2026-109322.md) `CVE-2026-109322` · CVE record: getgrav grav-plugin-guestbook · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification](https://agentprime.io/advisories/CVE-2026-109307.md) `CVE-2026-109307` · CVE record: craftcms cms · CVSS 2.1 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds](https://agentprime.io/advisories/CVE-2026-109300.md) `CVE-2026-109300` · CVE record: open-webui open-webui · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url](https://agentprime.io/advisories/CVE-2026-109291.md) `CVE-2026-109291` · CVE record: open-webui open-webui · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview](https://agentprime.io/advisories/CVE-2026-109290.md) `CVE-2026-109290` · CVE record: open-webui open-webui · CVSS 8.4 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-1021 - [Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links](https://agentprime.io/advisories/CVE-2026-109288.md) `CVE-2026-109288` · CVE record: open-webui open-webui · CVSS 7.2 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder](https://agentprime.io/advisories/CVE-2026-109266.md) `CVE-2026-109266` · CVE record: ImageMagick ImageMagick · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview](https://agentprime.io/advisories/CVE-2026-109392.md) `CVE-2026-109392` · CVE record: Pimcore Pimcore · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Netis WF2409E Wireless Settings cross site scripting](https://agentprime.io/advisories/CVE-2026-108898.md) `CVE-2026-108898` · CVE record: Netis WF2409E · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [CVE-2026-103527](https://agentprime.io/advisories/CVE-2026-103527.md) `CVE-2026-103527` · CVE record: Thelia Thelia · CVSS 6.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [CVE-2026-103524](https://agentprime.io/advisories/CVE-2026-103524.md) `CVE-2026-103524` · CVE record: Thelia Thelia · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting](https://agentprime.io/advisories/CVE-2026-108834.md) `CVE-2026-108834` · CVE record: Cairo-dock Glx-Dock · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5](https://agentprime.io/advisories/CVE-2026-105410.md) `CVE-2026-105410` · CVE record: Dassault Systèmes Tuleap Enterprise Edition · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5](https://agentprime.io/advisories/CVE-2026-105409.md) `CVE-2026-105409` · CVE record: Dassault Systèmes Tuleap Enterprise Edition · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5](https://agentprime.io/advisories/CVE-2026-105408.md) `CVE-2026-105408` · CVE record: Dassault Systèmes Tuleap Enterprise Edition · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-107864.md) `CVE-2026-107864` · CVE record: Igor Funa Ad Inserter · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-107865.md) `CVE-2026-107865` · CVE record: Crocoblock JetMenu · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-107866.md) `CVE-2026-107866` · CVE record: Crocoblock JetElements For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108168.md) `CVE-2026-108168` · CVE record: DLX Plugins Custom Query Blocks · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [idcCMS member_deal.php cross site scripting](https://agentprime.io/advisories/CVE-2026-108815.md) `CVE-2026-108815` · CVE record: idcCMS · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Stored XSS in external pages](https://agentprime.io/advisories/CVE-2026-48212.md) `CVE-2026-48212` · CVE record: OTRS GmbH (former OTRS AG) OTRS · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [WP Job Openings < 4.0.0 - Admin+ Stored XSS](https://agentprime.io/advisories/CVE-2025-15703.md) `CVE-2025-15703` · CVE record: Unknown HireZoot · CVSS 3.5 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS) - [y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting](https://agentprime.io/advisories/CVE-2026-108802.md) `CVE-2026-108802` · CVE record: y_project RuoYi · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)](https://agentprime.io/advisories/CVE-2026-108925.md) `CVE-2026-108925` · CVE record: Cohesity NetBackup Administration Console web interface · CVSS 6.1 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass](https://agentprime.io/advisories/CVE-2026-108852.md) `CVE-2026-108852` · CVE record: OvidijusParsiunas Deep Chat · CVSS 2.1 Low · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin](https://agentprime.io/advisories/CVE-2026-108725.md) `CVE-2026-108725` · CVE record: cheshire-cat-ai core · CVSS 5.1 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [open-computer-use through commit 610bac8 Stored XSS via log.html Session Log](https://agentprime.io/advisories/CVE-2026-108722.md) `CVE-2026-108722` · CVE record: e2b-dev open-computer-use · CVSS 2.3 Low · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [InstantSoft icms2 Private Message index.tpl.php index cross site scripting](https://agentprime.io/advisories/CVE-2026-108566.md) `CVE-2026-108566` · CVE record: InstantSoft icms2 · CVSS 5.1 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload](https://agentprime.io/advisories/CVE-2026-96227.md) `CVE-2026-96227` · CVE record: Unknown Piotnet Forms · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter](https://agentprime.io/advisories/CVE-2026-91829.md) `CVE-2026-91829` · CVE record: Unknown Subscribe to Comments · CVSS 7.1 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings](https://agentprime.io/advisories/CVE-2026-88905.md) `CVE-2026-88905` · CVE record: Unknown KeyWord Collector · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook](https://agentprime.io/advisories/CVE-2026-88903.md) `CVE-2026-88903` · CVE record: Unknown Topcontent · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums](https://agentprime.io/advisories/CVE-2026-88826.md) `CVE-2026-88826` · CVE record: Unknown SmugMug Embed · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message](https://agentprime.io/advisories/CVE-2026-87764.md) `CVE-2026-87764` · CVE record: Unknown BuddyPress Instant Chat · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling](https://agentprime.io/advisories/CVE-2026-87762.md) `CVE-2026-87762` · CVE record: Unknown Adwised Web Push Notification · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings](https://agentprime.io/advisories/CVE-2026-87761.md) `CVE-2026-87761` · CVE record: Unknown Adwised Web Push Notification · CVSS 8.0 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name](https://agentprime.io/advisories/CVE-2026-87760.md) `CVE-2026-87760` · CVE record: Unknown Web Vitals Tracking · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint](https://agentprime.io/advisories/CVE-2026-86798.md) `CVE-2026-86798` · CVE record: Unknown HootBoard · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications](https://agentprime.io/advisories/CVE-2026-84261.md) `CVE-2026-84261` · CVE record: Unknown click5 CRM add-on to Contact Form 7 · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications](https://agentprime.io/advisories/CVE-2026-84260.md) `CVE-2026-84260` · CVE record: Unknown click5 CRM add-on to Gravity Forms · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications](https://agentprime.io/advisories/CVE-2026-84259.md) `CVE-2026-84259` · CVE record: Unknown click5 CRM add-on to WPForms · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications](https://agentprime.io/advisories/CVE-2026-84258.md) `CVE-2026-84258` · CVE record: Unknown click5 CRM add-on to Ninja Forms · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings](https://agentprime.io/advisories/CVE-2026-81156.md) `CVE-2026-81156` · CVE record: Unknown Robo Gallery · CVSS 6.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label](https://agentprime.io/advisories/CVE-2026-81155.md) `CVE-2026-81155` · CVE record: Unknown Robo Gallery · CVSS 6.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text](https://agentprime.io/advisories/CVE-2026-81154.md) `CVE-2026-81154` · CVE record: Unknown Robo Gallery · CVSS 6.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) - [Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta](https://agentprime.io/advisories/CVE-2026-81153.md) `CVE-2026-81153` · CVE record: Unknown Robo Gallery · CVSS 6.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .