# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181](https://agentprime.io/advisories/CVE-2026-96379.md) `CVE-2026-96379` · CVE record: Drupal CookieCuttr · CVSS 3.5 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS) - [Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191](https://agentprime.io/advisories/CVE-2026-96382.md) `CVE-2026-96382` · CVE record: Drupal Diba carousel slider · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS) - [A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.](https://agentprime.io/advisories/CVE-2025-69723.md) `CVE-2025-69723` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS) - [An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the \_loc…](https://agentprime.io/advisories/CVE-2025-65200.md) `CVE-2025-65200` · CVE record · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76303.md) `CVE-2026-76303` · CVE record: Splunk Splunk SOAR · CVSS 5.7 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts](https://agentprime.io/advisories/CVE-2026-107588.md) `CVE-2026-107588` · CVE record: vaadin vaadin and 3 more · CVSS 8.4 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS), Prototype pollution - [Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.](https://agentprime.io/advisories/DRUPAL-CONTRIB-2026-229.md) `DRUPAL-CONTRIB-2026-229`, `CVE-2026-107260` · Packagist `drupal/sector`: affected `<10.3.3 || >=10.4.0, <10.4.2`, fixed in `10.3.3`, `10.4.2` · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization](https://agentprime.io/advisories/GHSA-7jg5-frgc-c67w.md) `GHSA-7jg5-frgc-c67w`, `CVE-2026-112958` · npm `apostrophe`: affected `<4.34.0`, fixed in `4.34.0` · CVSS 5.4 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix](https://agentprime.io/advisories/GHSA-vmgj-9cwm-cf3h.md) `GHSA-vmgj-9cwm-cf3h`, `CVE-2026-112951` · npm `apostrophe`: affected `<4.34.0`, fixed in `4.34.0` · CVSS 5.4 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Vite: Cross origin script execution through Vite custom middleware](https://agentprime.io/advisories/GHSA-9jrq-w75r-8gcw.md) `GHSA-9jrq-w75r-8gcw`, `CVE-2026-112945` · npm `vite` and 1 more: affected `<6.4.4 || >=7.0.0, <7.3.7 || >=8.0.0, <8.1.6 || >=8.2.0, <8.2.4 || >=8.3.0, <8.3.3`, fixed in `6.4.4`, `7.3.7`, `8.1.6`, `8.2.4`, `8.3.3` · CVSS 2.1 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76475.md) `CVE-2026-76475` · CVE record: Cisco Cisco Emergency Responder and 3 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-111848.md) `CVE-2026-111848` · CVE record: Dylan Kuhn Geo Mashup · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112221.md) `CVE-2026-112221` · CVE record: Brainstorm Force SureCart · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-111837.md) `CVE-2026-111837` · CVE record: Wasiliy Strecker Contest Gallery · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-111838.md) `CVE-2026-111838` · CVE record: ThemeHunk ThemeHunk Customizer · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-111840.md) `CVE-2026-111840` · CVE record: VideoWhisper.com Paid Videochat Turnkey Site · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection](https://agentprime.io/advisories/CVE-2024-5139.md) `CVE-2024-5139` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions](https://agentprime.io/advisories/CVE-2026-114404.md) `CVE-2026-114404` · CVE record: PHPOffice PHPPresentation · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter](https://agentprime.io/advisories/CVE-2026-114407.md) `CVE-2026-114407` · CVE record: e107inc e107 · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-110884.md) `CVE-2026-110884` · CVE record: geekontheroad Live Summary for Gravity Forms · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL](https://agentprime.io/advisories/CVE-2026-85683.md) `CVE-2026-85683` · CVE record: Unknown Jane Menu · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-110899.md) `CVE-2026-110899` · CVE record: Kevin Stover Ninja Forms · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-107435.md) `CVE-2026-107435` · CVE record: WP Chill Strong Testimonials · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting](https://agentprime.io/advisories/CVE-2026-88784.md) `CVE-2026-88784` · CVE record: Unknown Translate WordPress with Weglot 2.0 · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass](https://agentprime.io/advisories/CVE-2026-81813.md) `CVE-2026-81813` · CVE record: Unknown Elementor Website Builder · CVSS 6.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload](https://agentprime.io/advisories/CVE-2026-81812.md) `CVE-2026-81812` · CVE record: Unknown Elementor Website Builder · CVSS 6.4 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass](https://agentprime.io/advisories/CVE-2026-79627.md) `CVE-2026-79627` · CVE record: Unknown Advanced File Manager · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions](https://agentprime.io/advisories/CVE-2026-111948.md) `CVE-2026-111948` · CVE record: Unknown User Profile Builder · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox](https://agentprime.io/advisories/CVE-2026-111574.md) `CVE-2026-111574` · CVE record: Unknown Redirection for Contact Form 7 · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter](https://agentprime.io/advisories/CVE-2026-109147.md) `CVE-2026-109147` · CVE record: Unknown WP Booking System · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title](https://agentprime.io/advisories/CVE-2026-107790.md) `CVE-2026-107790` · CVE record: Unknown HireZoot · CVSS 6.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation](https://agentprime.io/advisories/CVE-2026-105262.md) `CVE-2026-105262` · CVE record: Unknown Falang multilanguage for WordPress · CVSS 8.0 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages](https://agentprime.io/advisories/GHSA-85pr-xr59-r75h.md) `GHSA-85pr-xr59-r75h` · npm `@sveltejs/kit`: affected `*`, no fixed version yet · CVSS 4.7 Medium · Withdrawn · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS) - [itsourcecode Online Cake Ordering System 404.php cross site scripting](https://agentprime.io/advisories/CVE-2026-113741.md) `CVE-2026-113741` · CVE record: itsourcecode Online Cake Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection - [IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation](https://agentprime.io/advisories/CVE-2026-94402.md) `CVE-2026-94402` · CVE record: IBM @carbon/charts and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [Cachet has Stored XSS in Incident Component](https://agentprime.io/advisories/GHSA-x397-5hrv-j9m9.md) `GHSA-x397-5hrv-j9m9`, `CVE-2026-113712`, `PKSA-b73h-txx9-5t8m` · Packagist `cachethq/cachet`: affected `<=2.4.1`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Google Chrome](https://agentprime.io/advisories/CVE-2026-113274.md) `CVE-2026-113274` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter](https://agentprime.io/advisories/CVE-2016-20102.md) `CVE-2016-20102` · CVE record: JavaMelody JavaMelody · CVSS 5.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php](https://agentprime.io/advisories/CVE-2014-125132.md) `CVE-2014-125132` · CVE record: Jason Newman Blogroll Fun · CVSS 5.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php](https://agentprime.io/advisories/CVE-2014-125131.md) `CVE-2014-125131` · CVE record: DedeCMS DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter](https://agentprime.io/advisories/CVE-2012-20005.md) `CVE-2012-20005` · CVE record: Łukasz Więcek SocialFit · CVSS 5.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter](https://agentprime.io/advisories/CVE-2012-20004.md) `CVE-2012-20004` · CVE record: Carles Reverter K-news · CVSS 5.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php](https://agentprime.io/advisories/CVE-2012-20003.md) `CVE-2012-20003` · CVE record: Web Updates KMU Custom Tables · CVSS 5.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS in the VPN logs monitor](https://agentprime.io/advisories/CVE-2026-111088.md) `CVE-2026-111088` · CVE record: Stormshield Stormshield Network Security · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS on SNS Enrollment Portal](https://agentprime.io/advisories/CVE-2026-113810.md) `CVE-2026-113810` · CVE record: Stormshield Stormshield Network Security · CVSS 7.0 High · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)](https://agentprime.io/advisories/GHSA-374f-7chj-9948.md) `GHSA-374f-7chj-9948`, `CVE-2026-113657` · npm `sanitize-html`: affected `>=2.17.7, <2.18.0`, fixed in `2.18.0` · CVSS 3.7 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users](https://agentprime.io/advisories/GHSA-m2m5-rw3w-cwmj.md) `GHSA-m2m5-rw3w-cwmj`, `CVE-2026-113659` · npm `apostrophe`: affected `<4.33.0`, fixed in `4.33.0` · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS), Prototype pollution - [Stored XSS on SNS Enrollment Portal](https://agentprime.io/advisories/CVE-2026-113808.md) `CVE-2026-113808` · CVE record: Stormshield Stormshield Network Security · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [ApostropheCMS: Incomplete CVE-2026-53606: \`meta http-equiv=refresh\` \`content\` still ships \`javascript:\` / \`data:\` URLs](https://agentprime.io/advisories/GHSA-cv27-6wvh-8x7j.md) `GHSA-cv27-6wvh-8x7j`, `CVE-2026-113661` · npm `sanitize-html`: affected `<2.18.0`, fixed in `2.18.0` · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting \