# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Stored XSS Fazile BACAK's DefterAsist Financial Advisor Platform](https://agentprime.io/advisories/CVE-2026-16020.md)
  `CVE-2026-16020` · CVE record: Fazile BACAK DefterAsist Financial Advisor Platform · CVSS 5.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter](https://agentprime.io/advisories/CVE-2026-101935.md)
  `CVE-2026-101935` · CVE record: echoplugins Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute](https://agentprime.io/advisories/CVE-2026-109975.md)
  `CVE-2026-109975` · CVE record: cozythemes Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter](https://agentprime.io/advisories/CVE-2026-118169.md)
  `CVE-2026-118169` · CVE record: wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups · CVSS 4.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute](https://agentprime.io/advisories/CVE-2026-109370.md)
  `CVE-2026-109370` · CVE record: bplugins Document Embedder – let visitors read files without downloading · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-77871.md)
  `CVE-2026-77871` · CVE record: saadiqbal Post Snippets – Custom WordPress Code Snippets Customizer · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title](https://agentprime.io/advisories/CVE-2026-107710.md)
  `CVE-2026-107710` · CVE record: wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter](https://agentprime.io/advisories/CVE-2026-109988.md)
  `CVE-2026-109988` · CVE record: acowebs Product Addons for Woocommerce – Product Options with Custom Fields · CVSS 4.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form](https://agentprime.io/advisories/CVE-2026-116761.md)
  `CVE-2026-116761` · CVE record: jtsternberg CMB2 · CVSS 5.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute](https://agentprime.io/advisories/CVE-2026-108366.md)
  `CVE-2026-108366` · CVE record: wpdevteam easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-110071.md)
  `CVE-2026-110071` · CVE record: kitae-park Mang Board · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape](https://agentprime.io/advisories/CVE-2026-111111.md)
  `CVE-2026-111111` · CVE record: bdthemes Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute](https://agentprime.io/advisories/CVE-2026-116749.md)
  `CVE-2026-116749` · CVE record: e4jvikwp VikRentCar Car Rental Management System · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter](https://agentprime.io/advisories/CVE-2026-92098.md)
  `CVE-2026-92098` · CVE record: webheadllc Webheadcoder Multi-Step Forms for Contact Form 7 · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-104729.md)
  `CVE-2026-104729` · CVE record: themefusion Avada (Fusion) Builder · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter](https://agentprime.io/advisories/CVE-2026-118164.md)
  `CVE-2026-118164` · CVE record: ifso If-So Dynamic Content – Elementor & All Page Builders Personalization · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink](https://agentprime.io/advisories/CVE-2026-100175.md)
  `CVE-2026-100175` · CVE record: wayneallen-1 Postie · CVSS 5.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-77188.md)
  `CVE-2026-77188` · CVE record: xootix Waitlist Woocommerce ( Back in stock notifier ) · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-104740.md)
  `CVE-2026-104740` · CVE record: ifso If-So Dynamic Content – Elementor & All Page Builders Personalization · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute](https://agentprime.io/advisories/CVE-2026-109978.md)
  `CVE-2026-109978` · CVE record: cozythemes Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-109972.md)
  `CVE-2026-109972` · CVE record: clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute](https://agentprime.io/advisories/CVE-2026-111068.md)
  `CVE-2026-111068` · CVE record: justinnealey DesignSetGo · CVSS 4.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-109590.md)
  `CVE-2026-109590` · CVE record: magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL](https://agentprime.io/advisories/CVE-2026-109385.md)
  `CVE-2026-109385` · CVE record: posimyththemes UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute](https://agentprime.io/advisories/CVE-2026-103996.md)
  `CVE-2026-103996` · CVE record: ifso If-So Dynamic Content – Elementor & All Page Builders Personalization · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating](https://agentprime.io/advisories/CVE-2026-110662.md)
  `CVE-2026-110662` · CVE record: mxchat MxChat – AI Chatbot & Content Generation for WordPress · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion](https://agentprime.io/advisories/CVE-2026-103370.md)
  `CVE-2026-103370` · CVE record: awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute](https://agentprime.io/advisories/CVE-2026-113488.md)
  `CVE-2026-113488` · CVE record: Unknown GeoDirectory · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute](https://agentprime.io/advisories/CVE-2026-113487.md)
  `CVE-2026-113487` · CVE record: Unknown GeoDirectory · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-111967.md)
  `CVE-2026-111967` · CVE record: Unknown MP3 Audio Player · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter](https://agentprime.io/advisories/CVE-2026-111021.md)
  `CVE-2026-111021` · CVE record: Unknown افزونه پیامک ووکامرس | Persian WooCommerce SMS · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-110524.md)
  `CVE-2026-110524` · CVE record: Unknown Copy Anything to Clipboard for WordPress · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class](https://agentprime.io/advisories/CVE-2026-110506.md)
  `CVE-2026-110506` · CVE record: Unknown Page Builder by SiteOrigin · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting](https://agentprime.io/advisories/CVE-2026-107098.md)
  `CVE-2026-107098` · CVE record: Unknown Royal Addons for Elementor · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute](https://agentprime.io/advisories/CVE-2026-105972.md)
  `CVE-2026-105972` · CVE record: Unknown Menu Cart for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter](https://agentprime.io/advisories/CVE-2026-111727.md)
  `CVE-2026-111727` · CVE record: codepeople Appointment Booking Calendar · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC](https://agentprime.io/advisories/CVE-2026-109209.md)
  `CVE-2026-109209` · CVE record: plugins360 All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter](https://agentprime.io/advisories/CVE-2026-111314.md)
  `CVE-2026-111314` · CVE record: cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-\*' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-97019.md)
  `CVE-2026-97019` · CVE record: mohammed_kaludi AMP for WP – Accelerated Mobile Pages · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter](https://agentprime.io/advisories/CVE-2026-109999.md)
  `CVE-2026-109999` · CVE record: nalam-1 AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-109974.md)
  `CVE-2026-109974` · CVE record: plugins360 All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field](https://agentprime.io/advisories/CVE-2026-107625.md)
  `CVE-2026-107625` · CVE record: ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter](https://agentprime.io/advisories/CVE-2013-20009.md)
  `CVE-2013-20009` · CVE record: Linksys WAG200G · CVSS 4.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WebSub: Reflected script execution through intent-verification challenges](https://agentprime.io/advisories/CVE-2026-50571.md)
  `CVE-2026-50571` · CVE record: w3c websub · CVSS 5.7 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GRR has a Reflected XSS issue](https://agentprime.io/advisories/CVE-2026-58205.md)
  `CVE-2026-58205` · CVE record: JeromeDevome GRR · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net](https://agentprime.io/advisories/GO-2026-6866.md)
  `GO-2026-6866`, `CVE-2026-97045` · Go `golang.org/x/net`: affected `<0.62.0`, fixed in `0.62.0` · CVSS 6.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin \`data-mce-object\` serialization](https://agentprime.io/advisories/GHSA-mf2p-h6hf-fcwm.md)
  `GHSA-mf2p-h6hf-fcwm`, `CVE-2026-116675`, `PKSA-bdqg-yq3b-xsg6` · npm `tinymce` and 2 more: affected `>=7.9.3, <7.9.4 || >=8.5.1, <8.9.3`, fixed in `7.9.4`, `8.9.3` · CVSS 8.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [CKEditor: Cross-site scripting (XSS) in the engine package](https://agentprime.io/advisories/GHSA-v6mg-96c6-gmpq.md)
  `GHSA-v6mg-96c6-gmpq`, `CVE-2026-116687` · npm `ckeditor5` and 1 more: affected `>=29.0.0, <47.7.4 || >=48.0.0, <48.5.1`, fixed in `47.7.4`, `48.5.1` · CVSS 3.1 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [CKEditor: Cross-site scripting (XSS) in the engine package](https://agentprime.io/advisories/GHSA-rh54-vffm-5fvp.md)
  `GHSA-rh54-vffm-5fvp`, `CVE-2026-116688` · npm `ckeditor5` and 1 more: affected `>=45.0.0, <47.7.4 || >=48.0.0, <48.5.1`, fixed in `47.7.4`, `48.5.1` · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [CVE-2026-118132](https://agentprime.io/advisories/CVE-2026-118132.md)
  `CVE-2026-118132` · CVE record: NextChat NextChat · CVSS 6.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-104350.md)
  `CVE-2026-104350` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment](https://agentprime.io/advisories/CVE-2026-112353.md)
  `CVE-2026-112353` · CVE record: GFI USA, LLC GFI KerioConnect · CVSS 6.2 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop](https://agentprime.io/advisories/CVE-2026-102638.md)
  `CVE-2026-102638` · CVE record: Autodesk Fusion · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop](https://agentprime.io/advisories/CVE-2026-102637.md)
  `CVE-2026-102637` · CVE record: Autodesk Fusion · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop](https://agentprime.io/advisories/CVE-2026-102636.md)
  `CVE-2026-102636` · CVE record: Autodesk Fusion · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LiteLLM vulnerable to reflected XSS in /sso/debug/callback](https://agentprime.io/advisories/GHSA-hhww-mrg2-969h.md)
  `GHSA-hhww-mrg2-969h` · PyPI `litellm`: affected `>=1.65.5, <1.85.0`, fixed in `1.85.0` · CVSS 6.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored XSS in KGS Software tia Viewer](https://agentprime.io/advisories/CVE-2026-105987.md)
  `CVE-2026-105987` · CVE record: KGS Software tia Viewer · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Devolutions PowerShell Universal](https://agentprime.io/advisories/CVE-2026-116627.md)
  `CVE-2026-116627` · CVE record: Devolutions PowerShell Universal · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Reflected XSS in Kulga Software's Kulga News Software](https://agentprime.io/advisories/CVE-2026-105323.md)
  `CVE-2026-105323` · CVE record: Kulga Software and Telecommunications Limited Company Kulga News Software · CVSS 6.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content](https://agentprime.io/advisories/CVE-2026-109995.md)
  `CVE-2026-109995` · CVE record: wplakeorg Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode · CVSS 7.2 High · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTI3VDExOjMyOjAzLjczNTAwMFoiLCJDVkUtMjAyNi0xMDk5OTUiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTI4VDEwOjEwOjI0LjE5ODAwMFoiLCJDVkUtMjAyNi04NzA5OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTI4VDEwOjEwOjI0LjE5ODAwMFoiLCJDVkUtMjAyNi04NzA5OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.