# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter](https://agentprime.io/advisories/CVE-2026-109936.md)
  `CVE-2026-109936` · CVE record: Unknown Otter Blocks · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes](https://agentprime.io/advisories/CVE-2026-109933.md)
  `CVE-2026-109933` · CVE record: Unknown Otter Blocks · CVSS 6.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter](https://agentprime.io/advisories/CVE-2026-109198.md)
  `CVE-2026-109198` · CVE record: cleantalk CleanTalk Anti-Spam – Complete Spam Protection · CVSS 7.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer](https://agentprime.io/advisories/CVE-2026-59188.md)
  `CVE-2026-59188` · CVE record: Part-DB Part-DB-server · CVSS 5.4 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Part-DB: Stored HTML injection in BOM validation results via unescaped Part name](https://agentprime.io/advisories/CVE-2026-55600.md)
  `CVE-2026-55600` · CVE record: Part-DB Part-DB-server · CVSS 5.7 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)](https://agentprime.io/advisories/CVE-2026-54615.md)
  `CVE-2026-54615` · CVE record: Part-DB Part-DB-server · CVSS 6.0 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS)
- [gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting](https://agentprime.io/advisories/CVE-2026-115536.md)
  `CVE-2026-115536` · CVE record: gedelumbung HospitalManagement · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting](https://agentprime.io/advisories/CVE-2026-115535.md)
  `CVE-2026-115535` · CVE record: gedelumbung HospitalManagement · CVSS 4.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting](https://agentprime.io/advisories/CVE-2026-115534.md)
  `CVE-2026-115534` · CVE record: gedelumbung HospitalManagement · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header](https://agentprime.io/advisories/CVE-2026-115507.md)
  `CVE-2026-115507` · CVE record: go-vikunja vikunja · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Mistune before 3.3.0 Stored XSS via Include Directive HTML Files](https://agentprime.io/advisories/CVE-2026-115350.md)
  `CVE-2026-115350` · CVE record: lepture mistune · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-95717.md)
  `CVE-2026-95717` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 5.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Agent Zero Web UI XSS](https://agentprime.io/advisories/CVE-2026-97635.md)
  `CVE-2026-97635` · CVE record: Agent Zero Agent Zero · CVSS 8.6 High · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Nuxt server islands render \`useHeadSafe\` input without sanitisation](https://agentprime.io/advisories/GHSA-xfq5-w38q-pc2x.md)
  `GHSA-xfq5-w38q-pc2x`, `CVE-2026-114133` · npm `nuxt`: affected `>=3.13.0, <4.6.2`, fixed in `4.6.2` · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel](https://agentprime.io/advisories/CVE-2026-115513.md)
  `CVE-2026-115513` · CVE record: opencats OpenCATS · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a \`javascript:\` URL prefixed with an ASCII control character executes from \`\<NuxtLink>\` when \`pages\` is disabled](https://agentprime.io/advisories/GHSA-jjm6-p2m9-9w4x.md)
  `GHSA-jjm6-p2m9-9w4x`, `CVE-2026-114130` · npm `nuxt`: affected `<4.6.0`, fixed in `4.6.0` · CVSS 2.3 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Astro: Reflected/Stored XSS via unescaped \<script>/\<style> tag content in JSX/MDX rendering](https://agentprime.io/advisories/GHSA-98hj-9722-w3j8.md)
  `GHSA-98hj-9722-w3j8`, `CVE-2026-114128` · npm `astro`: affected `<7.3.2`, fixed in `7.3.2` · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Astro: Arbitrary CSS injection in Astro View Transitions](https://agentprime.io/advisories/GHSA-mpr7-6m5w-76rw.md)
  `GHSA-mpr7-6m5w-76rw`, `CVE-2026-114127` · npm `astro`: affected `>=7.1.0, <7.3.3`, fixed in `7.3.3` · CVSS 2.3 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes](https://agentprime.io/advisories/GHSA-cg2g-xh64-v4q7.md)
  `GHSA-cg2g-xh64-v4q7`, `CVE-2026-116804` · npm `dompurify`: affected `>=3.4.4, <3.4.17`, fixed in `3.4.17` · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)](https://agentprime.io/advisories/GHSA-mrv2-3pqr-j5jr.md)
  `GHSA-mrv2-3pqr-j5jr`, `CVE-2026-116803` · npm `dompurify`: affected `<3.4.17`, fixed in `3.4.17` · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-693
- [DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml](https://agentprime.io/advisories/GHSA-c6gr-qvv4-5v3f.md)
  `GHSA-c6gr-qvv4-5v3f`, `CVE-2026-116802` · npm `dompurify`: affected `<3.4.17`, fixed in `3.4.17` · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [OCO-Server: Stored XSS through agent hostnames in command buttons](https://agentprime.io/advisories/CVE-2026-61791.md)
  `CVE-2026-61791` · CVE record: schorschii OCO-Server · CVSS 7.4 High · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ammonia: mXSS via MathML \`annotation-xml\` encoding strip](https://agentprime.io/advisories/GHSA-9jh8-v38h-cvhr.md)
  `GHSA-9jh8-v38h-cvhr`, `CVE-2026-63430`, `RUSTSEC-2026-0193` · crates.io `ammonia`: affected `<3.3.2 || >=4.0.0, <4.0.2 || >=4.1.0, <4.1.3`, fixed in `3.3.2`, `4.0.2`, `4.1.3` · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting](https://agentprime.io/advisories/CVE-2026-115246.md)
  `CVE-2026-115246` · CVE record: subhajitkhan online-clinic-management-system · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Retool < 3.88.0 XSS via /api/imageProxy SVG Proxying](https://agentprime.io/advisories/CVE-2024-58394.md)
  `CVE-2024-58394` · CVE record: Retool Retool · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang](https://agentprime.io/advisories/CVE-2023-54413.md)
  `CVE-2023-54413` · CVE record: OnTheGoSystems WPML Multilingual CMS · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Sickbeard build-507 Reflected XSS via testNaming pattern Parameter](https://agentprime.io/advisories/CVE-2020-37284.md)
  `CVE-2020-37284` · CVE record: midgetspy Sickbeard · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed](https://agentprime.io/advisories/CVE-2017-20290.md)
  `CVE-2017-20290` · CVE record: Discourse Discourse · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [QCubed 3.1.1 Reflected XSS via installer step_2.php](https://agentprime.io/advisories/CVE-2017-20288.md)
  `CVE-2017-20288` · CVE record: QCubed QCubed · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112313.md)
  `CVE-2026-112313` · CVE record: ACF Extended ACF Extended · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114703.md)
  `CVE-2026-114703` · CVE record: hupe13 Extensions for Leaflet Map · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114702.md)
  `CVE-2026-114702` · CVE record: nicdark ND Shortcodes For Visual Composer · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114701.md)
  `CVE-2026-114701` · CVE record: xootix Waitlist Woocommerce ( Back in stock notifier ) · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114700.md)
  `CVE-2026-114700` · CVE record: Gloriafood Restaurant Menu – Food Ordering System – Table Reservation · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-111830.md)
  `CVE-2026-111830` · CVE record: WP Mailster WP Mailster · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112845.md)
  `CVE-2026-112845` · CVE record: Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112379.md)
  `CVE-2026-112379` · CVE record: Codepeople Contact Form Email · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-112867.md)
  `CVE-2026-112867` · CVE record: H5P H5P · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114184.md)
  `CVE-2026-114184` · CVE record: WPVibes Elementor Addon Elements · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser](https://agentprime.io/advisories/CVE-2026-97328.md)
  `CVE-2026-97328` · CVE record: Unknown WebP Express · CVSS 7.5 High · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter](https://agentprime.io/advisories/CVE-2026-78392.md)
  `CVE-2026-78392` · CVE record: Unknown Link Library · CVSS 6.8 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name](https://agentprime.io/advisories/CVE-2026-111971.md)
  `CVE-2026-111971` · CVE record: Unknown Photo Engine (Media Organizer & Lightroom) · CVSS 6.8 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie](https://agentprime.io/advisories/CVE-2026-109987.md)
  `CVE-2026-109987` · CVE record: Unknown PixelYourSite and 1 more · CVSS 7.2 High · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit](https://agentprime.io/advisories/CVE-2026-114570.md)
  `CVE-2026-114570` · CVE record: WordPress Foundation WordPress · CVSS 4.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-114718.md)
  `CVE-2026-114718` · CVE record: Roundcube Webmail · CVSS 4.7 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119](https://agentprime.io/advisories/CVE-2026-84911.md)
  `CVE-2026-84911` · CVE record: Drupal AI (Artificial Intelligence) · CVSS 3.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123](https://agentprime.io/advisories/CVE-2026-84915.md)
  `CVE-2026-84915` · CVE record: Drupal Component blocks · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125](https://agentprime.io/advisories/CVE-2026-84924.md)
  `CVE-2026-84924` · CVE record: Drupal Email Verification / SMS Verification / OTP Verification · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131](https://agentprime.io/advisories/CVE-2026-84919.md)
  `CVE-2026-84919` · CVE record: Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137](https://agentprime.io/advisories/CVE-2026-87939.md)
  `CVE-2026-87939` · CVE record: Drupal Feed Block · CVSS 4.2 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140](https://agentprime.io/advisories/CVE-2026-87942.md)
  `CVE-2026-87942` · CVE record: Drupal SafeDelete · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146](https://agentprime.io/advisories/CVE-2026-87948.md)
  `CVE-2026-87948` · CVE record: Drupal SAML SSO - Service Provider · CVSS 3.5 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147](https://agentprime.io/advisories/CVE-2026-87949.md)
  `CVE-2026-87949` · CVE record: Drupal SAML SSO - Service Provider · CVSS 3.3 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154](https://agentprime.io/advisories/CVE-2026-96360.md)
  `CVE-2026-96360` · CVE record: Drupal Webform · CVSS 3.5 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155](https://agentprime.io/advisories/CVE-2026-96361.md)
  `CVE-2026-96361` · CVE record: Drupal Webform · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158](https://agentprime.io/advisories/CVE-2026-96358.md)
  `CVE-2026-96358` · CVE record: Drupal Webform · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159](https://agentprime.io/advisories/CVE-2026-96359.md)
  `CVE-2026-96359` · CVE record: Drupal Webform · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160](https://agentprime.io/advisories/CVE-2026-96362.md)
  `CVE-2026-96362` · CVE record: Drupal Webform · CVSS 4.2 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163](https://agentprime.io/advisories/CVE-2026-96368.md)
  `CVE-2026-96368` · CVE record: Drupal Webform · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172](https://agentprime.io/advisories/CVE-2026-96357.md)
  `CVE-2026-96357` · CVE record: Drupal Webform · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTIyVDAxOjIxOjM1LjU1NjAwMFoiLCJDVkUtMjAyNi05NjM1NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTIzVDA2OjAwOjE4LjYyMTAwMFoiLCJDVkUtMjAyNi0xMTE3MzciXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTIzVDA2OjAwOjE4LjYyMTAwMFoiLCJDVkUtMjAyNi0xMTE3MzciXQ>. Everything for agents: <https://agentprime.io/llms.txt>.