# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115613.md)
  `CVE-2026-115613` · CVE record: bPlugins Image Gallery block – Create and display photo gallery/photo album. · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio](https://agentprime.io/advisories/CVE-2026-4316.md)
  `CVE-2026-4316` · CVE record: Zuinq Studio IsMyGym · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha](https://agentprime.io/advisories/CVE-2026-103377.md)
  `CVE-2026-103377` · CVE record: Regional Parliament of Castile-La Mancha Video library of the Regional Parliament of Castile-La Mancha · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Multiple cross-site scripting (XSS) in OPNsense](https://agentprime.io/advisories/CVE-2026-115425.md)
  `CVE-2026-115425` · CVE record: OPNsense OPNsense firewall · CVSS 5.6 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting](https://agentprime.io/advisories/CVE-2026-116229.md)
  `CVE-2026-116229` · CVE record: ffxiv-teamcraft FFXIV Teamcraft · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Edimax BR-6208AC Virtual Server cross site scripting](https://agentprime.io/advisories/CVE-2026-116227.md)
  `CVE-2026-116227` · CVE record: Edimax BR-6208AC · CVSS 4.8 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [gougucms User Level Level.php add cross site scripting](https://agentprime.io/advisories/CVE-2026-116100.md)
  `CVE-2026-116100` · CVE record: gougucms · CVSS 4.8 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [CloudClassroom-PHP-Project addnewstudent.php cross site scripting](https://agentprime.io/advisories/CVE-2026-116097.md)
  `CVE-2026-116097` · CVE record: CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax](https://agentprime.io/advisories/CVE-2026-116206.md)
  `CVE-2026-116206` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters](https://agentprime.io/advisories/CVE-2026-116203.md)
  `CVE-2026-116203` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload](https://agentprime.io/advisories/CVE-2026-116202.md)
  `CVE-2026-116202` · CVE record: YesWiki yeswiki · CVSS 5.1 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks](https://agentprime.io/advisories/CVE-2026-116169.md)
  `CVE-2026-116169` · CVE record: siyuan-note siyuan · CVSS 5.1 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter](https://agentprime.io/advisories/CVE-2026-116167.md)
  `CVE-2026-116167` · CVE record: siyuan-note siyuan · CVSS 7.6 High · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options](https://agentprime.io/advisories/CVE-2026-116148.md)
  `CVE-2026-116148` · CVE record: ImageMagick ImageMagick · CVSS 4.8 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering](https://agentprime.io/advisories/CVE-2026-116139.md)
  `CVE-2026-116139` · CVE record: WWBN AVideo · CVSS 5.1 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Privoce Vocechat Query Parameter widget.html cross site scripting](https://agentprime.io/advisories/CVE-2026-116047.md)
  `CVE-2026-116047` · CVE record: Privoce Vocechat · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color](https://agentprime.io/advisories/CVE-2026-111979.md)
  `CVE-2026-111979` · CVE record: Unknown GiveWP · CVSS 6.8 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS](https://agentprime.io/advisories/CVE-2025-15705.md)
  `CVE-2025-15705` · CVE record: Unknown Contact Form by Supsystic · CVSS 3.5 Low · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [onyx-dot-app Onyx PreviewTab.tsx cross site scripting](https://agentprime.io/advisories/CVE-2026-116004.md)
  `CVE-2026-116004` · CVE record: onyx-dot-app Onyx · CVSS 5.1 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting](https://agentprime.io/advisories/CVE-2026-115982.md)
  `CVE-2026-115982` · CVE record: phpIPAM · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [phpIPAM index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-115981.md)
  `CVE-2026-115981` · CVE record: phpIPAM · CVSS 4.8 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114194.md)
  `CVE-2026-114194` · CVE record: Igor Funa Ad Inserter · CVSS 6.5 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored XSS in the “Notes” field of project checklists](https://agentprime.io/advisories/CVE-2026-115993.md)
  `CVE-2026-115993` · CVE record: CervantesSec cervantes · CVSS 6.8 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114695.md)
  `CVE-2026-114695` · CVE record: Infomaniak Network VOD Infomaniak · CVSS 7.1 High · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114694.md)
  `CVE-2026-114694` · CVE record: Pixelite Events Manager · CVSS 7.1 High · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114693.md)
  `CVE-2026-114693` · CVE record: Plugins360 Labs All-in-One Video Gallery · CVSS 6.5 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114697.md)
  `CVE-2026-114697` · CVE record: QuarkA QA Analytics · CVSS 7.1 High · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114178.md)
  `CVE-2026-114178` · CVE record: Bold Grid W3 Total Cache · CVSS 7.1 High · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112869.md)
  `CVE-2026-112869` · CVE record: Noah Hearle We’re Open! · CVSS 7.1 High · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112844.md)
  `CVE-2026-112844` · CVE record: Arraytics WP Event Solution · CVSS 7.1 High · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114179.md)
  `CVE-2026-114179` · CVE record: wordplus BP Better Messages · CVSS 7.1 High · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content](https://agentprime.io/advisories/CVE-2026-114429.md)
  `CVE-2026-114429` · CVE record: Unknown WPVR · CVSS 6.8 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute](https://agentprime.io/advisories/CVE-2026-113493.md)
  `CVE-2026-113493` · CVE record: Unknown GeoDirectory · CVSS 6.8 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link](https://agentprime.io/advisories/CVE-2026-112207.md)
  `CVE-2026-112207` · CVE record: Unknown Download Monitor · CVSS 7.1 High · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID](https://agentprime.io/advisories/CVE-2026-105199.md)
  `CVE-2026-105199` · CVE record: Unknown Pixel Tag Manager for WooCommerce · CVSS 6.8 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Serialize JavaScript: Cross-site scripting (XSS) via unescaped \</script at the end of a serialized function body](https://agentprime.io/advisories/GHSA-m5mm-p8h7-m29v.md)
  `GHSA-m5mm-p8h7-m29v`, `CVE-2026-115754`, `CVE-2026-115897` · npm `serialize-javascript`: affected `<7.1.3`, fixed in `7.1.3` · CVSS 2.3 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values](https://agentprime.io/advisories/GHSA-2rqm-h6hv-g79v.md)
  `GHSA-2rqm-h6hv-g79v` · npm `odf-kit`: affected `>=0.9.8, <0.14.2`, fixed in `0.14.2` · CVSS 6.1 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SvelteKit : XSS via untrusted cache-control header in prerendered page](https://agentprime.io/advisories/GHSA-27mw-82g8-phjj.md)
  `GHSA-27mw-82g8-phjj`, `CVE-2026-114061` · npm `@sveltejs/kit`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 2.3 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in phpBB](https://agentprime.io/advisories/CVE-2026-87901.md)
  `CVE-2026-87901` · CVE record: phpBB phpBB · CVSS 8.3 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5](https://agentprime.io/advisories/CVE-2026-102786.md)
  `CVE-2026-102786` · CVE record: phoca.cz Phoca Gallery extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS](https://agentprime.io/advisories/CVE-2026-55486.md)
  `CVE-2026-55486` · CVE record: intranda goobi-viewer-core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS), Other injection, Code injection
- [GFI Archiver < 15.14 Stored XSS via MailInsights.aspx](https://agentprime.io/advisories/CVE-2026-112333.md)
  `CVE-2026-112333` · CVE record: GFI Software GFI Archiver · CVSS 5.1 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments](https://agentprime.io/advisories/CVE-2026-115457.md)
  `CVE-2026-115457` · CVE record: baserproject basercms · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter](https://agentprime.io/advisories/CVE-2026-93638.md)
  `CVE-2026-93638` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 6.1 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters](https://agentprime.io/advisories/CVE-2026-93633.md)
  `CVE-2026-93633` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 5.4 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter](https://agentprime.io/advisories/CVE-2026-10632.md)
  `CVE-2026-10632` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112849.md)
  `CVE-2026-112849` · CVE record: AivahThemes Hostme v2 · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112863.md)
  `CVE-2026-112863` · CVE record: Hogash KALLYAS · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard](https://agentprime.io/advisories/CVE-2026-55422.md)
  `CVE-2026-55422` · CVE record: conda-forge conda-forge.github.io · CVSS 4.6 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Reflected Cross-Site Scripting (XSS) in CGM CLININET](https://agentprime.io/advisories/CVE-2025-58403.md)
  `CVE-2025-58403` · CVE record: CGM CGM CLININET · CVSS 5.1 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112835.md)
  `CVE-2026-112835` · CVE record: e4jvikwp VikRentCar · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112838.md)
  `CVE-2026-112838` · CVE record: e4jvikwp VikRentCar · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem](https://agentprime.io/advisories/CVE-2026-4952.md)
  `CVE-2026-4952` · CVE record: VertiGIS Ltd. WebOrderSystem (AuftragsManager) · CVSS 5.1 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem](https://agentprime.io/advisories/CVE-2026-4951.md)
  `CVE-2026-4951` · CVE record: VertiGIS Ltd. WebOrderSystem (KundenManager) · CVSS 5.1 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem](https://agentprime.io/advisories/CVE-2026-4950.md)
  `CVE-2026-4950` · CVE record: VertiGIS Ltd. WebOrderSystem (KundenManager) · CVSS 4.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-94264.md)
  `CVE-2026-94264` · CVE record: Unknown Advanced Custom Fields: Extended and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization](https://agentprime.io/advisories/CVE-2026-113500.md)
  `CVE-2026-113500` · CVE record: Unknown LiteSpeed Cache · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting](https://agentprime.io/advisories/CVE-2026-113499.md)
  `CVE-2026-113499` · CVE record: Unknown LiteSpeed Cache · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-111966.md)
  `CVE-2026-111966` · CVE record: Unknown User Profile Builder · CVSS 6.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists](https://agentprime.io/advisories/CVE-2026-111737.md)
  `CVE-2026-111737` · CVE record: Unknown Speed Optimizer · CVSS 3.5 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTIzVDA2OjAwOjE4LjYyMTAwMFoiLCJDVkUtMjAyNi0xMTE3MzciXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTI2VDA5OjU5OjI0Ljg0NTAwMFoiLCJDVkUtMjAyNi0xMTU2MDIiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTI2VDA5OjU5OjI0Ljg0NTAwMFoiLCJDVkUtMjAyNi0xMTU2MDIiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.