# Cross-site scripting (XSS). Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267](https://agentprime.io/advisories/CVE-2026-118546.md) `CVE-2026-118546` · CVE record: Drupal AI (Artificial Intelligence) · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS) - [AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269](https://agentprime.io/advisories/CVE-2026-118549.md) `CVE-2026-118549` · CVE record: Drupal AI (Artificial Intelligence) · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS) - [AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272](https://agentprime.io/advisories/CVE-2026-118552.md) `CVE-2026-118552` · CVE record: Drupal AI (Artificial Intelligence) · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS) - [AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273](https://agentprime.io/advisories/CVE-2026-118553.md) `CVE-2026-118553` · CVE record: Drupal AI (Artificial Intelligence) · CVSS 5.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS) - [Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285](https://agentprime.io/advisories/CVE-2026-118575.md) `CVE-2026-118575` · CVE record: Drupal Signature pad widget · CVSS 6.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286](https://agentprime.io/advisories/CVE-2026-118576.md) `CVE-2026-118576` · CVE record: Drupal Stage File Proxy · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS) - [Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality, chat messaging component.](https://agentprime.io/advisories/CVE-2026-37468.md) `CVE-2026-37468` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS) - [An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted…](https://agentprime.io/advisories/CVE-2026-117182.md) `CVE-2026-117182` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS) - [WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field](https://agentprime.io/advisories/CVE-2026-61719.md) `CVE-2026-61719` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.9 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover](https://agentprime.io/advisories/CVE-2026-61673.md) `CVE-2026-61673` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass](https://agentprime.io/advisories/GHSA-v3f7-2p4r-mwfw.md) `GHSA-v3f7-2p4r-mwfw`, `BIT-keycloak-2026-9086`, `CVE-2026-9086` · Maven `org.keycloak:keycloak-services`: affected `<26.6.4`, fixed in `26.6.4` · CVSS 7.3 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-108494.md) `CVE-2026-108494` · CVE record: Bob Chained Quiz · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-61995.md) `CVE-2026-61995` · CVE record: emarket-design YouTube Showcase · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-61993.md) `CVE-2026-61993` · CVE record: blockonomics Blockonomics · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-61989.md) `CVE-2026-61989` · CVE record: Merv Barrett Easy Property Listings · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-61988.md) `CVE-2026-61988` · CVE record: morehawes Auction Nudge – Your eBay on Your Site · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-54866.md) `CVE-2026-54866` · CVE record: Razorpay Razorpay Payment Button Elementor Plugin · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-54865.md) `CVE-2026-54865` · CVE record: Podamibe Nepal Podamibe Custom User Gravatar · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-54864.md) `CVE-2026-54864` · CVE record: nicashmu Post Video Players · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-42692.md) `CVE-2026-42692` · CVE record: Themeum WP Crowdfunding · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-27394.md) `CVE-2026-27394` · CVE record: Jyothis Joy Eventer · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-118085.md) `CVE-2026-118085` · CVE record: Global Payments GlobalPayments WooCommerce · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting in Zimbra](https://agentprime.io/advisories/CVE-2026-66912.md) `CVE-2026-66912` · CVE record: Synacor Zimbra Collaboration · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting in Zimbra](https://agentprime.io/advisories/CVE-2026-66911.md) `CVE-2026-66911` · CVE record: Synacor Zimbra Collaboration · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42694.md) `CVE-2026-42694` · CVE record: Themeum Kirki · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116848.md) `CVE-2026-116848` · CVE record: POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-118097.md) `CVE-2026-118097` · CVE record: bPlugins Flash & HTML5 Video · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114706.md) `CVE-2026-114706` · CVE record: WP Chill Strong Testimonials · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-118095.md) `CVE-2026-118095` · CVE record: David Lingren Media LIbrary Assistant · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116850.md) `CVE-2026-116850` · CVE record: weDevs Happy Addons for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116849.md) `CVE-2026-116849` · CVE record: bPlugins StreamCast · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-110881.md) `CVE-2026-110881` · CVE record: Brainstorm Force SureDash · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-39737.md) `CVE-2026-39737` · CVE record: Crocoblock JetElements For Elementor · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-39742.md) `CVE-2026-39742` · CVE record: Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-115610.md) `CVE-2026-115610` · CVE record: PublishPress PublishPress Authors · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116402.md) `CVE-2026-116402` · CVE record: Brainstorm Force SureForms · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-48202.md) `CVE-2026-48202` · CVE record: Brave Brave · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25467.md) `CVE-2026-25467` · CVE record: ThemeGrill User Registration · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116857.md) `CVE-2026-116857` · CVE record: Crocoblock JetSmartFilters · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Reflected Cross-Site Scripting in BMC Helix Operations Management](https://agentprime.io/advisories/CVE-2026-113697.md) `CVE-2026-113697` · CVE record: BMC BMC Helix Operations Management · CVSS 4.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Reflected Cross-Site Scripting in BMC ITSM SmartIT](https://agentprime.io/advisories/CVE-2026-113695.md) `CVE-2026-113695` · CVE record: BMC BMC IT Service Management Suite · CVSS 4.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-54862.md) `CVE-2026-54862` · CVE record: Codection Import and export users and customers · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url](https://agentprime.io/advisories/CVE-2026-119054.md) `CVE-2026-119054` · CVE record: Themeisle Multiple Pages Generator by Themeisle · CVSS 5.1 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-48195.md) `CVE-2026-48195` · CVE record: bPlugins PDF Poster · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting in BMC ITSM Knowledge Articles](https://agentprime.io/advisories/CVE-2026-113691.md) `CVE-2026-113691` · CVE record: BMC BMC IT Service Management Suite · CVSS 5.1 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-48196.md) `CVE-2026-48196` · CVE record: Kaliforms Kali Forms · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-52709.md) `CVE-2026-52709` · CVE record: bPlugins Video Gallery Block · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting in BMC ITSM Attachments](https://agentprime.io/advisories/CVE-2026-113690.md) `CVE-2026-113690` · CVE record: BMC BMC IT Service Management Suite · CVSS 4.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting in BMC ITSM Work Notes](https://agentprime.io/advisories/CVE-2026-113689.md) `CVE-2026-113689` · CVE record: BMC BMC IT Service Management Suite · CVSS 5.1 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-24533.md) `CVE-2026-24533` · CVE record: CozyThemes Cozy Blocks · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-118087.md) `CVE-2026-118087` · CVE record: Gemini Labs Site Reviews · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-118094.md) `CVE-2026-118094` · CVE record: Igor Funa Ad Inserter · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-56056.md) `CVE-2026-56056` · CVE record: Mamunur Rashid The Post Grid · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters](https://agentprime.io/advisories/CVE-2026-115821.md) `CVE-2026-115821` · CVE record: newsmanapp NewsmanApp · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys](https://agentprime.io/advisories/CVE-2026-109216.md) `CVE-2026-109216` · CVE record: metabox Meta Box – A Framework for Dynamic Websites · CVSS 4.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header](https://agentprime.io/advisories/CVE-2026-96767.md) `CVE-2026-96767` · CVE record: webaways NEX-Forms – Ultimate Forms Plugin for WordPress · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application](https://agentprime.io/advisories/CVE-2026-5700.md) `CVE-2026-5700` · CVE record: SABBATIC SABBATIC app · CVSS 4.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application](https://agentprime.io/advisories/CVE-2026-5699.md) `CVE-2026-5699` · CVE record: SABBATIC SABBATIC app · CVSS 4.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application](https://agentprime.io/advisories/CVE-2026-5698.md) `CVE-2026-5698` · CVE record: SABBATIC SABBATIC app · CVSS 4.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) - [Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application](https://agentprime.io/advisories/CVE-2026-5697.md) `CVE-2026-5697` · CVE record: SABBATIC SABBATIC app · CVSS 4.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .