# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others](https://agentprime.io/advisories/CVE-2026-63355.md)
  `CVE-2026-63355` · CVE record: Siemens SIMATIC Drive Controller CPU 1504D TF and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others](https://agentprime.io/advisories/CVE-2026-63354.md)
  `CVE-2026-63354` · CVE record: Siemens SIMATIC Drive Controller CPU 1504D TF and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others](https://agentprime.io/advisories/CVE-2026-63353.md)
  `CVE-2026-63353` · CVE record: Siemens SIMATIC Drive Controller CPU 1504D TF and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others](https://agentprime.io/advisories/CVE-2026-63352.md)
  `CVE-2026-63352` · CVE record: Siemens SIMATIC Drive Controller CPU 1504D TF and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others](https://agentprime.io/advisories/CVE-2026-63351.md)
  `CVE-2026-63351` · CVE record: Siemens SIMATIC Drive Controller CPU 1504D TF and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108487.md)
  `CVE-2026-108487` · CVE record: Hossni Mubarak Books Gallery · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-105881.md)
  `CVE-2026-105881` · CVE record: ThemeGrill User Registration · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-109697.md)
  `CVE-2026-109697` · CVE record: Brainstorm Force SureCart · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting in the YouMind web application](https://agentprime.io/advisories/CVE-2026-96535.md)
  `CVE-2026-96535` · CVE record: YouMind YouMind web application · CVSS 5.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-109691.md)
  `CVE-2026-109691` · CVE record: BdThemes Prime Slider – Addons For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108488.md)
  `CVE-2026-108488` · CVE record: IdeaBox Creations PowerPack Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108490.md)
  `CVE-2026-108490` · CVE record: LeapWorx Premium Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108495.md)
  `CVE-2026-108495` · CVE record: Brainstorm Force SureForms · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback](https://agentprime.io/advisories/CVE-2026-102007.md)
  `CVE-2026-102007` · CVE record: bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation · CVSS 7.2 High · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField\[\]' Parameter](https://agentprime.io/advisories/CVE-2026-102562.md)
  `CVE-2026-102562` · CVE record: acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress · CVSS 7.2 High · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [HCL Connections is vulnerable to cross-site scripting (XSS)](https://agentprime.io/advisories/CVE-2026-67165.md)
  `CVE-2026-67165` · CVE record: HCLSoftware Connections · CVSS 5.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Universal XSS via the HTML language attribute in Translation Services](https://agentprime.io/advisories/CVE-2026-103418.md)
  `CVE-2026-103418` · CVE record: Mozilla Firefox for iOS · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode](https://agentprime.io/advisories/CVE-2026-89269.md)
  `CVE-2026-89269` · CVE record: Unknown WP Testimonials · CVSS 6.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-54867.md)
  `CVE-2026-54867` · CVE record: Griden Responsive Slider · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-54868.md)
  `CVE-2026-54868` · CVE record: FolioVision FV Simpler SEO · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-54869.md)
  `CVE-2026-54869` · CVE record: IDX Broker IMPress for IDX Broker · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-54870.md)
  `CVE-2026-54870` · CVE record: wpweaver Weaver Xtreme Theme Support · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab](https://agentprime.io/advisories/CVE-2026-92883.md)
  `CVE-2026-92883` · CVE record: GitLab GitLab · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal](https://agentprime.io/advisories/CVE-2026-89117.md)
  `CVE-2026-89117` · CVE record: SAP_SE SAP NetWeaver Enterprise Portal · CVSS 6.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)](https://agentprime.io/advisories/CVE-2026-76976.md)
  `CVE-2026-76976` · CVE record: SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) · CVSS 5.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)](https://agentprime.io/advisories/CVE-2026-76975.md)
  `CVE-2026-76975` · CVE record: SAP_SE SAPUI5 (Support Assistant Overlay) · CVSS 6.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence](https://agentprime.io/advisories/CVE-2026-76972.md)
  `CVE-2026-76972` · CVE record: SAP_SE SAP Manufacturing Integration and Intelligence · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting](https://agentprime.io/advisories/CVE-2026-108942.md)
  `CVE-2026-108942` · CVE record: philz1337x clarity-upscaler · CVSS 5.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability.](https://agentprime.io/advisories/CVE-2026-104587.md)
  `CVE-2026-104587` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint.](https://agentprime.io/advisories/CVE-2024-34326.md)
  `CVE-2024-34326` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.](https://agentprime.io/advisories/CVE-2024-34321.md)
  `CVE-2024-34321` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI](https://agentprime.io/advisories/CVE-2026-93886.md)
  `CVE-2026-93886` · CVE record: IBM i · CVSS 8.3 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [IBM Planning Analytics Local is affected by security vulnerabilities](https://agentprime.io/advisories/CVE-2026-18541.md)
  `CVE-2026-18541` · CVE record: IBM Planning Analytics · CVSS 6.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [IBM Planning Analytics Local is affected by security vulnerabilities](https://agentprime.io/advisories/CVE-2026-75063.md)
  `CVE-2026-75063` · CVE record: IBM Planning Analytics · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Edimax BR-6208AC QoS Page formQoS cross site scripting](https://agentprime.io/advisories/CVE-2026-108936.md)
  `CVE-2026-108936` · CVE record: Edimax BR-6208AC · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names](https://agentprime.io/advisories/CVE-2026-109673.md)
  `CVE-2026-109673` · CVE record: frappe erpnext · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages](https://agentprime.io/advisories/CVE-2026-109671.md)
  `CVE-2026-109671` · CVE record: frappe erpnext · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name](https://agentprime.io/advisories/CVE-2026-109670.md)
  `CVE-2026-109670` · CVE record: frappe erpnext · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form](https://agentprime.io/advisories/CVE-2026-109662.md)
  `CVE-2026-109662` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name](https://agentprime.io/advisories/CVE-2026-109657.md)
  `CVE-2026-109657` · CVE record: frappe erpnext · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover](https://agentprime.io/advisories/CVE-2026-109653.md)
  `CVE-2026-109653` · CVE record: frappe erpnext · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page](https://agentprime.io/advisories/CVE-2026-109633.md)
  `CVE-2026-109633` · CVE record: frappe erpnext · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.120.0 Stored XSS via Report View](https://agentprime.io/advisories/CVE-2026-109612.md)
  `CVE-2026-109612` · CVE record: frappe erpnext · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ERPNext before 15.112.0 Stored XSS via Tool View Record Names](https://agentprime.io/advisories/CVE-2026-109604.md)
  `CVE-2026-109604` · CVE record: frappe erpnext · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters](https://agentprime.io/advisories/CVE-2026-109602.md)
  `CVE-2026-109602` · CVE record: frappe frappe · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs](https://agentprime.io/advisories/CVE-2026-109597.md)
  `CVE-2026-109597` · CVE record: gohugoio hugo · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover](https://agentprime.io/advisories/CVE-2025-71432.md)
  `CVE-2025-71432` · CVE record: frappe erpnext · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe before 15.91.1 Stored XSS via Leaderboard User Names](https://agentprime.io/advisories/CVE-2025-71430.md)
  `CVE-2025-71430` · CVE record: frappe frappe · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe before 15.4.0 XSS via Printview Parameters](https://agentprime.io/advisories/CVE-2024-58391.md)
  `CVE-2024-58391` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe before 13.46.1 XSS via html2text Weak Sanitization](https://agentprime.io/advisories/CVE-2023-54409.md)
  `CVE-2023-54409` · CVE record: frappe frappe · CVSS 5.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe before 14.31.0 HTML Injection via Weak Escaping](https://agentprime.io/advisories/CVE-2023-54408.md)
  `CVE-2023-54408` · CVE record: frappe frappe · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Edimax BR-6208AC Port Forwarding formPortFw cross site scripting](https://agentprime.io/advisories/CVE-2026-108935.md)
  `CVE-2026-108935` · CVE record: Edimax BR-6208AC · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting](https://agentprime.io/advisories/CVE-2026-108934.md)
  `CVE-2026-108934` · CVE record: Edimax BR-6208AC · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values](https://agentprime.io/advisories/CVE-2026-104140.md)
  `CVE-2026-104140` · CVE record: qgis QGIS · CVSS 6.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Edimax BR-6208AC formFilter cross site scripting](https://agentprime.io/advisories/CVE-2026-108933.md)
  `CVE-2026-108933` · CVE record: Edimax BR-6208AC · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting](https://agentprime.io/advisories/CVE-2026-108932.md)
  `CVE-2026-108932` · CVE record: Netcore NR268 · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting](https://agentprime.io/advisories/CVE-2026-108931.md)
  `CVE-2026-108931` · CVE record: Netcore NR268 · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component](https://agentprime.io/advisories/CVE-2026-109565.md)
  `CVE-2026-109565` · CVE record: zofe rapyd-admin · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview](https://agentprime.io/advisories/CVE-2026-109558.md)
  `CVE-2026-109558` · CVE record: tianma-if EdgeEver · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)
- [EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview](https://agentprime.io/advisories/CVE-2026-109557.md)
  `CVE-2026-109557` · CVE record: tianma-if EdgeEver · CVSS 8.4 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTEyVDIwOjU1OjEzLjA2NzAwMFoiLCJDVkUtMjAyNi0xMDk1NTciXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTEzVDA5OjE4OjQ4LjgxODAwMFoiLCJDVkUtMjAyNi02MzM1NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTEzVDA5OjE4OjQ4LjgxODAwMFoiLCJDVkUtMjAyNi02MzM1NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.