# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0](https://agentprime.io/advisories/CVE-2026-102800.md) `CVE-2026-102800` · CVE record: dj-extensions.com DJ-HelpfulArticles extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass](https://agentprime.io/advisories/CVE-2026-117539.md) `CVE-2026-117539` · CVE record: darylldoyle svg-sanitizer · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool](https://agentprime.io/advisories/CVE-2026-117535.md) `CVE-2026-117535` · CVE record: redaxo core · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads](https://agentprime.io/advisories/CVE-2026-117533.md) `CVE-2026-117533` · CVE record: redaxo core · CVSS 2.1 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets](https://agentprime.io/advisories/CVE-2026-116900.md) `CVE-2026-116900` · CVE record: redaxo core · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile](https://agentprime.io/advisories/CVE-2026-116892.md) `CVE-2026-116892` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property](https://agentprime.io/advisories/CVE-2026-116889.md) `CVE-2026-116889` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading](https://agentprime.io/advisories/CVE-2026-116888.md) `CVE-2026-116888` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property](https://agentprime.io/advisories/CVE-2026-116887.md) `CVE-2026-116887` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse](https://agentprime.io/advisories/CVE-2026-116886.md) `CVE-2026-116886` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter](https://agentprime.io/advisories/CVE-2026-116885.md) `CVE-2026-116885` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-\* Attributes](https://agentprime.io/advisories/CVE-2026-116884.md) `CVE-2026-116884` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions](https://agentprime.io/advisories/CVE-2026-116883.md) `CVE-2026-116883` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels](https://agentprime.io/advisories/CVE-2026-116882.md) `CVE-2026-116882` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete](https://agentprime.io/advisories/CVE-2026-116881.md) `CVE-2026-116881` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters](https://agentprime.io/advisories/CVE-2026-116875.md) `CVE-2026-116875` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter](https://agentprime.io/advisories/CVE-2026-116874.md) `CVE-2026-116874` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [Multiple vulnerabilities in Sisense’s Cloud BI Platform](https://agentprime.io/advisories/CVE-2026-117493.md) `CVE-2026-117493` · CVE record: Sisense Cloud BI Platform · CVSS 8.3 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter](https://agentprime.io/advisories/CVE-2026-10511.md) `CVE-2026-10511` · CVE record: artbees Jupiter X Core · CVSS 6.4 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title](https://agentprime.io/advisories/CVE-2026-111820.md) `CVE-2026-111820` · CVE record: deconf Analytics Insights – Google Analytics Dashboard for WordPress · CVSS 7.2 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting](https://agentprime.io/advisories/CVE-2026-116640.md) `CVE-2026-116640` · CVE record: Saruf-Ratul HR-Payroll-Management-System · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting](https://agentprime.io/advisories/CVE-2026-116639.md) `CVE-2026-116639` · CVE record: MD-MAFUJUL-HASAN Online-Payroll-Management-System · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Cross-site scripting in Ubiquiti Inc airMAX M](https://agentprime.io/advisories/CVE-2026-116836.md) `CVE-2026-116836` · CVE record: Ubiquiti Inc airMAX M · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS) - [YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler](https://agentprime.io/advisories/CVE-2026-116824.md) `CVE-2026-116824` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [YesWiki before 4.7.0 Reflected XSS via BazarField $\_REQUEST Fallback](https://agentprime.io/advisories/CVE-2026-116823.md) `CVE-2026-116823` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [Argilla TextField.vue cross site scripting](https://agentprime.io/advisories/CVE-2026-116556.md) `CVE-2026-116556` · CVE record: Argilla · CVSS 4.8 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Argilla Sandbox.vue cross site scripting](https://agentprime.io/advisories/CVE-2026-116555.md) `CVE-2026-116555` · CVE record: Argilla · CVSS 4.8 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting](https://agentprime.io/advisories/CVE-2026-116554.md) `CVE-2026-116554` · CVE record: Argilla · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode Airline Reservation System book_flight.php cross site scripting](https://agentprime.io/advisories/CVE-2026-116514.md) `CVE-2026-116514` · CVE record: itsourcecode Airline Reservation System · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [subhajitkhan online-clinic-management-system patientregistration.php cross site scripting](https://agentprime.io/advisories/CVE-2026-116482.md) `CVE-2026-116482` · CVE record: subhajitkhan online-clinic-management-system · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Stored Cross-Site Scripting in Web Interface](https://agentprime.io/advisories/CVE-2026-70382.md) `CVE-2026-70382` · CVE record: WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro and 3 more · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages](https://agentprime.io/advisories/CVE-2026-57196.md) `CVE-2026-57196` · CVE record: asterisk asterisk and 1 more · CVSS 2.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [BUG-000187164 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-50096.md) `CVE-2026-50096` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [BUG-000187165 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-50095.md) `CVE-2026-50095` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [BUG-000185167 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-33520.md) `CVE-2026-33520` · CVE record: Esri ArcGIS Server · CVSS 6.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116408.md) `CVE-2026-116408` · CVE record: WP Chill Gallery PhotoBlocks · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115966.md) `CVE-2026-115966` · CVE record: bPlugins Typing Text – Give your texts many typing effects · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116400.md) `CVE-2026-116400` · CVE record: bPlugins Button Block · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116398.md) `CVE-2026-116398` · CVE record: bPlugins Content Slider Block · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting](https://agentprime.io/advisories/CVE-2026-116385.md) `CVE-2026-116385` · CVE record: Bdtask Garage 24 Garage Management Software · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116395.md) `CVE-2026-116395` · CVE record: bPlugins LightBox Block · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114710.md) `CVE-2026-114710` · CVE record: WP Chill Gallery PhotoBlocks · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116396.md) `CVE-2026-116396` · CVE record: TMS Amelia · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116394.md) `CVE-2026-116394` · CVE record: Magepeople inc. WpEvently · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes](https://agentprime.io/advisories/CVE-2026-116538.md) `CVE-2026-116538` · CVE record: mganss HtmlSanitizer · CVSS 2.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php](https://agentprime.io/advisories/CVE-2026-116217.md) `CVE-2026-116217` · CVE record: francoisjacquet rosariosis · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL](https://agentprime.io/advisories/CVE-2026-116212.md) `CVE-2026-116212` · CVE record: Webasyst Webasyst Framework · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7.](https://agentprime.io/advisories/CVE-2026-115193.md) `CVE-2026-115193` · CVE record · CVSS 8.2 High · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114708.md) `CVE-2026-114708` · CVE record: Crocoblock JetSmartFilters · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115955.md) `CVE-2026-115955` · CVE record: bPlugins Advanced Post Block - Post Grid for WordPress block editor · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115956.md) `CVE-2026-115956` · CVE record: bPlugins Panorama Viewer – 360 Degree Image + Video Viewer · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115961.md) `CVE-2026-115961` · CVE record: bPlugins B Slider · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114707.md) `CVE-2026-114707` · CVE record: Crocoblock JetElements For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115953.md) `CVE-2026-115953` · CVE record: Dylan Kuhn Geo Mashup · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115950.md) `CVE-2026-115950` · CVE record: WP Smart Widgets Better Post & Filter Widgets for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115951.md) `CVE-2026-115951` · CVE record: Kevin Weber Lazy Load for Videos · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114709.md) `CVE-2026-114709` · CVE record: Igor Funa Ad Inserter · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-97254.md) `CVE-2026-97254` · CVE record: WProyal Royal Elementor Addons · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112865.md) `CVE-2026-112865` · CVE record: WProyal Royal Elementor Addons · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115602.md) `CVE-2026-115602` · CVE record: Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .