# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115592.md)
  `CVE-2026-115592` · CVE record: OceanWP OceanWP · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116409.md)
  `CVE-2026-116409` · CVE record: WP Swings Upsell Order Bump Offer for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink](https://agentprime.io/advisories/CVE-2026-111318.md)
  `CVE-2026-111318` · CVE record: devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter](https://agentprime.io/advisories/CVE-2026-107743.md)
  `CVE-2026-107743` · CVE record: mapster Mapster WP Maps · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)](https://agentprime.io/advisories/CVE-2026-116763.md)
  `CVE-2026-116763` · CVE record: litespeedtech LiteSpeed Cache · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys](https://agentprime.io/advisories/CVE-2026-104727.md)
  `CVE-2026-104727` · CVE record: berocket Sequential Order Numbers for WooCommerce · CVSS 6.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization](https://agentprime.io/advisories/CVE-2026-109215.md)
  `CVE-2026-109215` · CVE record: litespeedtech LiteSpeed Cache · CVSS 6.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter](https://agentprime.io/advisories/CVE-2026-91152.md)
  `CVE-2026-91152` · CVE record: wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI · CVSS 6.1 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block](https://agentprime.io/advisories/CVE-2026-107627.md)
  `CVE-2026-107627` · CVE record: wpsoul Greenshift – animation and page builder blocks · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText](https://agentprime.io/advisories/CVE-2026-107629.md)
  `CVE-2026-107629` · CVE record: wpsoul Greenshift – animation and page builder blocks · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element](https://agentprime.io/advisories/CVE-2026-110707.md)
  `CVE-2026-110707` · CVE record: themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator · CVSS 4.7 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links](https://agentprime.io/advisories/CVE-2026-103875.md)
  `CVE-2026-103875` · CVE record: dglingren Media Library Assistant · CVSS 4.7 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property](https://agentprime.io/advisories/CVE-2026-103485.md)
  `CVE-2026-103485` · CVE record: hupe13 Extensions for Leaflet Map · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration](https://agentprime.io/advisories/CVE-2026-7190.md)
  `CVE-2026-7190` · CVE record: ICT Innovations ICT Innovations’ PHP-CGI/PHP-FPM configuration · CVSS 5.1 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form](https://agentprime.io/advisories/CVE-2026-86794.md)
  `CVE-2026-86794` · CVE record: Unknown Community Events · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass](https://agentprime.io/advisories/CVE-2026-110505.md)
  `CVE-2026-110505` · CVE record: Unknown Enable SVG, WebP, and ICO Upload · CVSS 6.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass](https://agentprime.io/advisories/CVE-2026-110504.md)
  `CVE-2026-110504` · CVE record: Unknown Enable SVG, WebP, and ICO Upload · CVSS 6.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings](https://agentprime.io/advisories/CVE-2026-105258.md)
  `CVE-2026-105258` · CVE record: Unknown Appointment Booking Plugin · CVSS 3.5 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LetterPress < 2.4.0 - Admin+ Stored XSS](https://agentprime.io/advisories/CVE-2024-3586.md)
  `CVE-2024-3586` · CVE record: Unknown LetterPress · CVSS 3.5 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler](https://agentprime.io/advisories/CVE-2026-93293.md)
  `CVE-2026-93293` · CVE record: saadiqbal Password Protected – Protect Your Site Content With a Password · CVSS 6.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter](https://agentprime.io/advisories/CVE-2026-96666.md)
  `CVE-2026-96666` · CVE record: vberkel Schema App Structured Data · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie](https://agentprime.io/advisories/CVE-2026-96669.md)
  `CVE-2026-96669` · CVE record: wpscripts Food Store – Online Food Delivery & Pickup · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption](https://agentprime.io/advisories/CVE-2026-96741.md)
  `CVE-2026-96741` · CVE record: mlfactory DSGVO All in one for WP · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in canva ortto](https://agentprime.io/advisories/CVE-2026-113409.md)
  `CVE-2026-113409` · CVE record: canva ortto · CVSS 4.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored XSS in pre-login notice via reachable legacy logon route](https://agentprime.io/advisories/CVE-2026-66092.md)
  `CVE-2026-66092` · CVE record: Apereo Foundation openEQUELLA · CVSS 4.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [configuroweb inventariobasico Add Product addlist.php cross site scripting](https://agentprime.io/advisories/CVE-2026-118585.md)
  `CVE-2026-118585` · CVE record: configuroweb inventariobasico · CVSS 5.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles](https://agentprime.io/advisories/CVE-2026-61575.md)
  `CVE-2026-61575` · CVE record: WWBN AVideo-Encoder · CVSS 4.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [AVideo-Encoder: reflected cross-site scripting in the login interface](https://agentprime.io/advisories/CVE-2026-61573.md)
  `CVE-2026-61573` · CVE record: WWBN AVideo-Encoder · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Seroval: Code injection through a typed array's own constructor property](https://agentprime.io/advisories/GHSA-f86p-h4j2-7qgj.md)
  `GHSA-f86p-h4j2-7qgj`, `CVE-2026-116583` · npm `seroval`: affected `>=1.6.0, <1.6.11`, fixed in `1.6.11` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Seroval: Script injection through RegExp sources in serialized output](https://agentprime.io/advisories/GHSA-9wx9-5pv9-3349.md)
  `GHSA-9wx9-5pv9-3349`, `CVE-2026-116582` · npm `seroval`: affected `<1.0.0 || >=1.5.5, <1.6.10`, fixed in `1.0.0`, `1.6.10` · CVSS 4.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Vue I18n: \`escapeParameter\` does not escape named values when the same call also passes a list](https://agentprime.io/advisories/GHSA-8rc2-428q-7ww3.md)
  `GHSA-8rc2-428q-7ww3`, `CVE-2026-118256` · npm `@intlify/core` and 4 more: affected `>=9.0.0-beta.10, <11.4.14 || >=12.0.0-alpha.1, <12.0.0-alpha.5`, fixed in `11.4.14`, `12.0.0-alpha.5` · CVSS 2.1 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages](https://agentprime.io/advisories/GHSA-83rm-6c8r-g728.md)
  `GHSA-83rm-6c8r-g728`, `CVE-2026-118257` · npm `@intlify/core` and 5 more: affected `>=11.1.10, <11.4.14 || >=12.0.0-alpha.4, <12.0.0-alpha.5`, fixed in `11.4.14`, `12.0.0-alpha.5` · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Highcharts Grid: \`javascript:\` URL in credits.href runs script on click](https://agentprime.io/advisories/GHSA-6hgp-fmhr-mrg4.md)
  `GHSA-6hgp-fmhr-mrg4`, `CVE-2026-118255` · npm `@highcharts/dashboards` and 1 more: affected `>=3.2.0, <4.0.0`, fixed in `4.0.0` · CVSS 8.4 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Highcharts Grid parses pagination language options as HTML](https://agentprime.io/advisories/GHSA-r5wg-q8fc-p6w2.md)
  `GHSA-r5wg-q8fc-p6w2`, `CVE-2026-118254` · npm `@highcharts/grid-lite` and 1 more: affected `>=2.0.0, <3.2.0`, fixed in `3.2.0` · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Highcharts Dashboards parses fullscreen labels as HTML](https://agentprime.io/advisories/GHSA-58g7-7f52-h92c.md)
  `GHSA-58g7-7f52-h92c`, `CVE-2026-118253` · npm `@highcharts/dashboards`: affected `>=1.0.0, <4.2.3`, fixed in `4.2.3` · CVSS 8.4 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Highcharts Dashboards parses sidebar component labels as HTML](https://agentprime.io/advisories/GHSA-rcqf-f6h2-ccg9.md)
  `GHSA-rcqf-f6h2-ccg9`, `CVE-2026-118252` · npm `@highcharts/dashboards`: affected `>=1.0.0, <4.2.3`, fixed in `4.2.3` · CVSS 8.4 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Highcharts: \`javascript:\` URL in credits.href runs script on click](https://agentprime.io/advisories/GHSA-5793-x2q3-c3q7.md)
  `GHSA-5793-x2q3-c3q7`, `CVE-2026-118251` · npm `highcharts`: affected `<11.4.9 || >=12.0.0, <12.6.1 || >=13.0.0, <13.1.0`, fixed in `11.4.9`, `12.6.1`, `13.1.0` · CVSS 8.4 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Highcharts Core: \`breadcrumbs.style\` keys become SVG event-handler attributes](https://agentprime.io/advisories/GHSA-35rr-xwfh-x789.md)
  `GHSA-35rr-xwfh-x789`, `CVE-2026-118246` · npm `highcharts`: affected `>=10.0.0, <11.4.9 || >=12.0.0, <12.6.1 || >=13.0.0, <13.1.0`, fixed in `11.4.9`, `12.6.1`, `13.1.0` · CVSS 8.4 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Highcharts Grid Pro: cell-renderer \`attributes\` map written with raw \`setAttribute\`](https://agentprime.io/advisories/GHSA-5ghw-9mgr-jvx2.md)
  `GHSA-5ghw-9mgr-jvx2`, `CVE-2026-116797` · npm `@highcharts/dashboards` and 1 more: affected `>=3.6.0, <4.0.0`, fixed in `4.0.0` · CVSS 8.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Highcharts Grid: custom icon definition objects written with raw \`setAttribute\` on \`\<path>\`](https://agentprime.io/advisories/GHSA-6g3c-p4fg-xv47.md)
  `GHSA-6g3c-p4fg-xv47`, `CVE-2026-118242` · npm `@highcharts/grid-lite` and 1 more: affected `>=2.3.0, <3.2.0`, fixed in `3.2.0` · CVSS 8.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Highcharts Dashboards: \`chartConstructor\` is an unchecked lookup into the Highcharts namespace](https://agentprime.io/advisories/GHSA-grj7-r4jv-pw9j.md)
  `GHSA-grj7-r4jv-pw9j`, `CVE-2026-118245` · npm `@highcharts/dashboards`: affected `>=1.0.0, <4.2.2`, fixed in `4.2.2` · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Highcharts Core: HTML text parsing falls back to unfiltered \`innerHTML\` during printing](https://agentprime.io/advisories/GHSA-65hg-cf3f-5m39.md)
  `GHSA-65hg-cf3f-5m39`, `CVE-2026-118244` · npm `highcharts`: affected `>=12.0.0, <12.6.1 || >=13.0.0, <13.1.0`, fixed in `12.6.1`, `13.1.0` · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Highcharts Core: \`javascript:\` URL in an \`xlink:href\` attribute survives text filtering and reaches exported charts](https://agentprime.io/advisories/GHSA-mw4f-gj5x-6xr4.md)
  `GHSA-mw4f-gj5x-6xr4`, `CVE-2026-116796` · npm `highcharts`: affected `>=10.3.2, <11.4.9 || >=12.0.0, <12.6.2 || >=13.0.0, <13.1.1`, fixed in `11.4.9`, `12.6.2`, `13.1.1` · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob](https://agentprime.io/advisories/GHSA-h9g5-28mm-hx3g.md)
  `GHSA-h9g5-28mm-hx3g`, `CVE-2026-118652`, `GO-2026-6876` · Go `github.com/labstack/echo/v4` and 1 more: affected `<4.16.0`, fixed in `4.16.0` · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS](https://agentprime.io/advisories/CVE-2026-63190.md)
  `CVE-2026-63190` · CVE record: fearlessgeekmedia FearlessCMS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal, Cross-site scripting (XSS), Information disclosure, Authentication bypass
- [Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products](https://agentprime.io/advisories/CVE-2026-11854.md)
  `CVE-2026-11854` · CVE record: WSO2 WSO2 API Manager and 2 more · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy](https://agentprime.io/advisories/CVE-2026-118648.md)
  `CVE-2026-118648` · CVE record: n8n-io n8n · CVSS 8.4 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Jenkins](https://agentprime.io/advisories/CVE-2026-117623.md)
  `CVE-2026-117623` · CVE record: Jenkins Project Jenkins · CVSS 5.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Jenkins](https://agentprime.io/advisories/CVE-2026-117622.md)
  `CVE-2026-117622` · CVE record: Jenkins Project Jenkins · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Jenkins](https://agentprime.io/advisories/CVE-2026-117621.md)
  `CVE-2026-117621` · CVE record: Jenkins Project Jenkins · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter](https://agentprime.io/advisories/CVE-2026-112356.md)
  `CVE-2026-112356` · CVE record: GFI USA, LLC GFI KerioConnect · CVSS 5.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115612.md)
  `CVE-2026-115612` · CVE record: iova.mihai SliceWP · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115593.md)
  `CVE-2026-115593` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115596.md)
  `CVE-2026-115596` · CVE record: impleCode eCommerce Product Catalog · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115957.md)
  `CVE-2026-115957` · CVE record: WP Discussion Board WP Discussion Board · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115606.md)
  `CVE-2026-115606` · CVE record: Crowd Favorite DXP ToolKit · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115609.md)
  `CVE-2026-115609` · CVE record: Stiofan GetPaid · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [HCL BigFix AEX is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67073.md)
  `CVE-2026-67073` · CVE record: HCL Software BigFix AEX · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), Broken access control, Unrestricted file upload, Information disclosure
- [Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12](https://agentprime.io/advisories/CVE-2026-102790.md)
  `CVE-2026-102790` · CVE record: icagenda.com iCagenda extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Acronis Cyber Protect 17](https://agentprime.io/advisories/CVE-2026-87099.md)
  `CVE-2026-87099` · CVE record: Acronis Acronis Cyber Protect 17 · CVSS 5.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTI4VDEwOjEwOjI0LjE5ODAwMFoiLCJDVkUtMjAyNi04NzA5OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTI5VDExOjAwOjI2LjI4MDAwMFoiLCJDVkUtMjAyNi0xMTU2MTEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTI5VDExOjAwOjI2LjI4MDAwMFoiLCJDVkUtMjAyNi0xMTU2MTEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.