# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [react-admin before 5.15.5 Stored XSS via UrlField and FileField](https://agentprime.io/advisories/CVE-2026-113350.md) `CVE-2026-113350` · CVE record: marmelab react-admin · CVSS 5.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-111844.md) `CVE-2026-111844` · CVE record: Brizy Brizy · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [TYPO3-EXT-SA-2026-033: Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)](https://agentprime.io/advisories/PKSA-s8v1-krjv-23c8.md) `PKSA-s8v1-krjv-23c8`, `CVE-2026-113442` · Packagist `codingms/fluid-form`: affected `<5.0.10 || >=6.0.0, <6.0.6`, fixed in `5.0.10`, `6.0.6` · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [Multiple vulnerabilities in FacturaScripts](https://agentprime.io/advisories/CVE-2026-11960.md) `CVE-2026-11960` · CVE record: FacturaScripts FacturaScripts · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [Multiple vulnerabilities in FacturaScripts](https://agentprime.io/advisories/CVE-2026-11959.md) `CVE-2026-11959` · CVE record: FacturaScripts FacturaScripts · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [Possible DOM XSS in SNS Web Administration Portal](https://agentprime.io/advisories/CVE-2026-113465.md) `CVE-2026-113465` · CVE record: Stormshield Stormshield Network Security · CVSS 6.6 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action](https://agentprime.io/advisories/CVE-2026-93878.md) `CVE-2026-93878` · CVE record: Divigear DiviGear Carousel · CVSS 6.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in LY Corporation LIFF SDK](https://agentprime.io/advisories/CVE-2026-112148.md) `CVE-2026-112148` · CVE record: LY Corporation LIFF SDK · CVSS 5.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting](https://agentprime.io/advisories/CVE-2026-112249.md) `CVE-2026-112249` · CVE record: grandnode grandnode2 · CVSS 4.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [IBM Cloud Pak System Cross-Site Scripting](https://agentprime.io/advisories/CVE-2023-38375.md) `CVE-2023-38375` · CVE record: IBM Cloud Pak System · CVSS 6.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [IBM Cloud Pak System Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-3295.md) `CVE-2026-3295` · CVE record: IBM Cloud Pak System · CVSS 7.4 High · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [IBM Cloud Pak System HTML Injection](https://agentprime.io/advisories/CVE-2026-4418.md) `CVE-2026-4418` · CVE record: IBM Cloud Pak System · CVSS 5.4 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [IBM Concert Software Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-4413.md) `CVE-2026-4413` · CVE record: IBM Concert · CVSS 6.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting](https://agentprime.io/advisories/CVE-2026-112247.md) `CVE-2026-112247` · CVE record: Wuxi Wubang Security Software Five-in-One Safety Production Management Information System · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML](https://agentprime.io/advisories/GHSA-2658-85cv-9wwq.md) `GHSA-2658-85cv-9wwq`, `CVE-2026-111059` · PyPI `mercury`: affected `>=3.0.0, <3.2.11`, fixed in `3.2.11` · CVSS 6.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection](https://agentprime.io/advisories/CVE-2025-6623.md) `CVE-2025-6623` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item](https://agentprime.io/advisories/CVE-2026-112290.md) `CVE-2026-112290` · CVE record: MI6 Intelligence Community UI Kit canary web components · CVSS 2.3 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin](https://agentprime.io/advisories/CVE-2026-112289.md) `CVE-2026-112289` · CVE record: KoalixSwitzerland koalixcrm · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-111414.md) `CVE-2026-111414` · CVE record: Crocoblock JetElements For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-111410.md) `CVE-2026-111410` · CVE record: E2Pdf.com e2pdf · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112199.md) `CVE-2026-112199` · CVE record: YITH YITH WooCommerce Wishlist · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [Apache Answer: Stored XSS via unsanitized HTML in imported question content](https://agentprime.io/advisories/CVE-2026-64944.md) `CVE-2026-64944` · CVE record: Apache Software Foundation Apache Answer · CVSS 5.4 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels](https://agentprime.io/advisories/CVE-2026-112184.md) `CVE-2026-112184` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-111407.md) `CVE-2026-111407` · CVE record: Themeum Tutor LMS · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-110379.md) `CVE-2026-110379` · CVE record: Ays Pro Quiz Maker · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting](https://agentprime.io/advisories/CVE-2026-112097.md) `CVE-2026-112097` · CVE record: SourceCodester Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting](https://agentprime.io/advisories/CVE-2026-112096.md) `CVE-2026-112096` · CVE record: SourceCodester Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Inventory System Product Management products_handler.php save cross site scripting](https://agentprime.io/advisories/CVE-2026-112095.md) `CVE-2026-112095` · CVE record: SourceCodester Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [subhajitkhan online-clinic-management-system feedback.php cross site scripting](https://agentprime.io/advisories/CVE-2026-112093.md) `CVE-2026-112093` · CVE record: subhajitkhan online-clinic-management-system · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting](https://agentprime.io/advisories/CVE-2026-112092.md) `CVE-2026-112092` · CVE record: subhajitkhan online-clinic-management-system · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-74921.md) `CVE-2026-74921` · CVE record: Unknown Document Gallery · CVSS 6.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload](https://agentprime.io/advisories/CVE-2026-106933.md) `CVE-2026-106933` · CVE record: Unknown Blaze Demo Importer · CVSS 6.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting](https://agentprime.io/advisories/CVE-2026-112042.md) `CVE-2026-112042` · CVE record: diem-project diem · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [diem-project diem Administrative Console actions.class.php append cross site scripting](https://agentprime.io/advisories/CVE-2026-112039.md) `CVE-2026-112039` · CVE record: diem-project diem · CVSS 4.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting](https://agentprime.io/advisories/CVE-2026-112038.md) `CVE-2026-112038` · CVE record: diem-project diem · CVSS 4.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitr…](https://agentprime.io/advisories/CVE-2026-38671.md) `CVE-2026-38671` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS) - [Chamilo LMS Ticket TicketManager.php addProject cross site scripting](https://agentprime.io/advisories/CVE-2026-112031.md) `CVE-2026-112031` · CVE record: Chamilo LMS · CVSS 5.1 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [Cross-site scripting in Bootstrap Shortcodes](https://agentprime.io/advisories/CVE-2026-112111.md) `CVE-2026-112111` · CVE record: Bootstrap Shortcodes project Bootstrap Shortcodes · CVSS 5.1 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS) - [AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting](https://agentprime.io/advisories/CVE-2026-111987.md) `CVE-2026-111987` · CVE record: AUTOMATIC1111 stable-diffusion-webui · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting](https://agentprime.io/advisories/CVE-2026-111984.md) `CVE-2026-111984` · CVE record: AUTOMATIC1111 stable-diffusion-webui · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-109895.md) `CVE-2026-109895` · CVE record: Arraytics Booktics · CVSS 7.1 High · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-110897.md) `CVE-2026-110897` · CVE record: IdeaBox Creations PowerPack Lite for Beaver Builder · CVSS 7.1 High · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-110382.md) `CVE-2026-110382` · CVE record: NSquared Simply Schedule Appointments · CVSS 7.1 High · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108485.md) `CVE-2026-108485` · CVE record: ThemeGrill eStore · CVSS 7.1 High · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS) - [hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting](https://agentprime.io/advisories/CVE-2026-111942.md) `CVE-2026-111942` · CVE record: hrisikeshpal Blood_Bank_Management_System · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter](https://agentprime.io/advisories/CVE-2026-110981.md) `CVE-2026-110981` · CVE record: Unknown WP Photo Album Plus · CVSS 7.1 High · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS) - [Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'](https://agentprime.io/advisories/CVE-2026-110033.md) `CVE-2026-110033` · CVE record: Unknown Salon Booking System · CVSS 6.8 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS) - [dext34-morgan Books4Cash search.php cross site scripting](https://agentprime.io/advisories/CVE-2026-111877.md) `CVE-2026-111877` · CVE record: dext34-morgan Books4Cash · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass](https://agentprime.io/advisories/CVE-2026-111903.md) `CVE-2026-111903` · CVE record: thorsten phpMyFAQ · CVSS 5.1 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) - [phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI](https://agentprime.io/advisories/CVE-2026-111894.md) `CVE-2026-111894` · CVE record: thorsten phpMyFAQ · CVSS 5.1 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-109701.md) `CVE-2026-109701` · CVE record: PAYCOMET PAYCOMET for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) - [European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header](https://agentprime.io/advisories/CVE-2026-100316.md) `CVE-2026-100316` · CVE record: davidanderson European VAT Compliance Assistant for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) - [YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter](https://agentprime.io/advisories/CVE-2026-109983.md) `CVE-2026-109983` · CVE record: wssoffice21 YMC Filter · CVSS 6.4 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) - [Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter](https://agentprime.io/advisories/CVE-2026-111110.md) `CVE-2026-111110` · CVE record: stiofansisland Payment forms, Buy now buttons, and Invoicing System | GetPaid · CVSS 7.2 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-110384.md) `CVE-2026-110384` · CVE record: Heateor Support Fancy Comments WordPress · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) - [EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter](https://agentprime.io/advisories/CVE-2026-103899.md) `CVE-2026-103899` · CVE record: daigo75 EU VAT Assistant for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) - [Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter](https://agentprime.io/advisories/CVE-2026-109989.md) `CVE-2026-109989` · CVE record: themifyme Themify Popup · CVSS 6.4 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) - [Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-111726.md) `CVE-2026-111726` · CVE record: themifyme Themify Builder · CVSS 6.4 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) - [User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value](https://agentprime.io/advisories/CVE-2026-96660.md) `CVE-2026-96660` · CVE record: wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder · CVSS 7.2 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) - [xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter](https://agentprime.io/advisories/CVE-2026-109985.md) `CVE-2026-109985` · CVE record: wpdevteam xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN · CVSS 6.4 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .