# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62057.md)
  `CVE-2026-62057` · CVE record: Fahim Reza Divi Contact Form 7 · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview](https://agentprime.io/advisories/CVE-2026-119764.md)
  `CVE-2026-119764` · CVE record: its-a-feature Mythic · CVSS 7.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name](https://agentprime.io/advisories/CVE-2026-119761.md)
  `CVE-2026-119761` · CVE record: Axigen Axigen Mail Server · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter](https://agentprime.io/advisories/CVE-2026-119113.md)
  `CVE-2026-119113` · CVE record: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · CVSS 6.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field](https://agentprime.io/advisories/CVE-2026-115869.md)
  `CVE-2026-115869` · CVE record: themifyme Themify Builder · CVSS 6.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments](https://agentprime.io/advisories/CVE-2026-109984.md)
  `CVE-2026-109984` · CVE record: foliovision FV Flowplayer Video Player · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter](https://agentprime.io/advisories/CVE-2026-104744.md)
  `CVE-2026-104744` · CVE record: Independent Analytics Independent Analytics Pro · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter](https://agentprime.io/advisories/CVE-2026-112365.md)
  `CVE-2026-112365` · CVE record: wpdevteam easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id](https://agentprime.io/advisories/CVE-2026-102918.md)
  `CVE-2026-102918` · CVE record: davidanderson Redux Framework · CVSS 6.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-110533.md)
  `CVE-2026-110533` · CVE record: foliovision FV Flowplayer Video Player · CVSS 6.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body](https://agentprime.io/advisories/CVE-2026-96894.md)
  `CVE-2026-96894` · CVE record: wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)](https://agentprime.io/advisories/CVE-2026-9239.md)
  `CVE-2026-9239` · CVE record: tigroumeow Meow Gallery · CVSS 6.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header](https://agentprime.io/advisories/CVE-2026-116552.md)
  `CVE-2026-116552` · CVE record: likebtn Like Button Rating ♥ LikeBtn · CVSS 4.7 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-110001.md)
  `CVE-2026-110001` · CVE record: foliovision FV Flowplayer Video Player · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter](https://agentprime.io/advisories/CVE-2026-119176.md)
  `CVE-2026-119176` · CVE record: codepeople CP Multi View Events Calendar · CVSS 6.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management](https://agentprime.io/advisories/CVE-2026-61804.md)
  `CVE-2026-61804` · CVE record: myTinyWMS myTinyWMS · CVSS 8.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Frappe LMS has Stored XSS in Course Meta](https://agentprime.io/advisories/CVE-2026-39375.md)
  `CVE-2026-39375` · CVE record: frappe lms · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-119365.md)
  `CVE-2026-119365` · CVE record: bPlugins Media Player Addons for Elementor – Media Player widget for WP · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored XSS via crafted URLs in HTML ticket content in Request Tracker](https://agentprime.io/advisories/CVE-2026-105454.md)
  `CVE-2026-105454` · CVE record: Best Practical Solutions Request Tracker · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored XSS via related ticket subject on RTIR Split and Create Incident forms](https://agentprime.io/advisories/CVE-2026-105455.md)
  `CVE-2026-105455` · CVE record: Best Practical Solutions RT for Incident Response · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored XSS via HTML scrubber rule in RTIR](https://agentprime.io/advisories/CVE-2026-105456.md)
  `CVE-2026-105456` · CVE record: Best Practical Solutions RT for Incident Response · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-119369.md)
  `CVE-2026-119369` · CVE record: Liquid Web / StellarWP The Events Calendar · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-119479.md)
  `CVE-2026-119479` · CVE record: Crocoblock JetFormBuilder · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Collabora Online: Reflected HTML injection through host_session_id](https://agentprime.io/advisories/CVE-2026-48164.md)
  `CVE-2026-48164` · CVE record: CollaboraOnline online · CVSS 4.7 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-119370.md)
  `CVE-2026-119370` · CVE record: Liquid Web / StellarWP The Events Calendar · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-65444.md)
  `CVE-2026-65444` · CVE record: Creative Themes Blocksy Companion · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Chamilo LMS: Stored XSS in public user-profile fields](https://agentprime.io/advisories/CVE-2026-45144.md)
  `CVE-2026-45144` · CVE record: chamilo chamilo-lms · CVSS 8.9 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php](https://agentprime.io/advisories/CVE-2015-20130.md)
  `CVE-2015-20130` · CVE record: Netsweeper Netsweeper · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover](https://agentprime.io/advisories/CVE-2026-61728.md)
  `CVE-2026-61728` · CVE record: socfortress CoPilot · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS), Information disclosure
- [Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature](https://agentprime.io/advisories/CVE-2026-119680.md)
  `CVE-2026-119680` · CVE record: ManageEngine SharePoint Manager Plus · CVSS 8.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stored XSS in Protectel](https://agentprime.io/advisories/CVE-2025-68395.md)
  `CVE-2025-68395` · CVE record: ARKETEAM PROTECTELMAJ and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name](https://agentprime.io/advisories/CVE-2026-119563.md)
  `CVE-2026-119563` · CVE record: phpMyAdmin phpMyAdmin · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID](https://agentprime.io/advisories/CVE-2026-85268.md)
  `CVE-2026-85268` · CVE record: Google Cloud Identity Platform and Firebase Authentication · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie](https://agentprime.io/advisories/CVE-2026-116622.md)
  `CVE-2026-116622` · CVE record: wpscripts Food Store – Online Food Delivery & Pickup · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field](https://agentprime.io/advisories/CVE-2026-97645.md)
  `CVE-2026-97645` · CVE record: Gravity Forms Gravity Forms · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values](https://agentprime.io/advisories/CVE-2026-90437.md)
  `CVE-2026-90437` · CVE record: Gravity Forms Gravity Forms · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute](https://agentprime.io/advisories/CVE-2026-118165.md)
  `CVE-2026-118165` · CVE record: Unknown Firelight Lightbox · CVSS 6.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute](https://agentprime.io/advisories/CVE-2026-118071.md)
  `CVE-2026-118071` · CVE record: Unknown Joinchat · CVSS 6.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters](https://agentprime.io/advisories/CVE-2026-117571.md)
  `CVE-2026-117571` · CVE record: Unknown WP Visitor Statistics (Real Time Traffic) · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter](https://agentprime.io/advisories/CVE-2026-115277.md)
  `CVE-2026-115277` · CVE record: Unknown User Frontend · CVSS 4.7 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-118634.md)
  `CVE-2026-118634` · CVE record: liedekef Events Made Easy · CVSS 6.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter](https://agentprime.io/advisories/CVE-2026-118500.md)
  `CVE-2026-118500` · CVE record: coolplugins Cool FormKit Lite – Advanced Form Builder for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195](https://agentprime.io/advisories/CVE-2026-107252.md)
  `CVE-2026-107252` · CVE record: Drupal MathJax: LaTeX for Drupal · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204](https://agentprime.io/advisories/CVE-2026-107265.md)
  `CVE-2026-107265` · CVE record: Drupal Leaflet · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209](https://agentprime.io/advisories/CVE-2026-107306.md)
  `CVE-2026-107306` · CVE record: Drupal Menu Link Attributes · CVSS 3.8 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211](https://agentprime.io/advisories/CVE-2026-107308.md)
  `CVE-2026-107308` · CVE record: Drupal Country · CVSS 3.1 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219](https://agentprime.io/advisories/CVE-2026-110738.md)
  `CVE-2026-110738` · CVE record: Drupal Gin Admin Theme · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221](https://agentprime.io/advisories/CVE-2026-114527.md)
  `CVE-2026-114527` · CVE record: Drupal UI Icons · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222](https://agentprime.io/advisories/CVE-2026-114528.md)
  `CVE-2026-114528` · CVE record: Drupal Zero Point · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223](https://agentprime.io/advisories/CVE-2026-114526.md)
  `CVE-2026-114526` · CVE record: Drupal Black Hole · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224](https://agentprime.io/advisories/CVE-2026-114525.md)
  `CVE-2026-114525` · CVE record: Drupal ABC · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226](https://agentprime.io/advisories/CVE-2026-114529.md)
  `CVE-2026-114529` · CVE record: Drupal CSV Field · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228](https://agentprime.io/advisories/CVE-2026-114531.md)
  `CVE-2026-114531` · CVE record: Drupal Swiper formatter · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230](https://agentprime.io/advisories/CVE-2026-114532.md)
  `CVE-2026-114532` · CVE record: Drupal UI Icons · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232](https://agentprime.io/advisories/CVE-2026-114534.md)
  `CVE-2026-114534` · CVE record: Drupal Block Attributes · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234](https://agentprime.io/advisories/CVE-2026-114536.md)
  `CVE-2026-114536` · CVE record: Drupal USWDS Paragraph Components · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236](https://agentprime.io/advisories/CVE-2026-114538.md)
  `CVE-2026-114538` · CVE record: Drupal Bootstrap · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250](https://agentprime.io/advisories/CVE-2026-114555.md)
  `CVE-2026-114555` · CVE record: Drupal Data field · CVSS 3.5 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265](https://agentprime.io/advisories/CVE-2026-118560.md)
  `CVE-2026-118560` · CVE record: Drupal Commerce Stripe · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266](https://agentprime.io/advisories/CVE-2026-118545.md)
  `CVE-2026-118545` · CVE record: Drupal AI (Artificial Intelligence) · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTMwVDAzOjA5OjAwLjM0NzAwMFoiLCJDVkUtMjAyNi0xMTg1NDUiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTEwLTMwVDE4OjA5OjQzLjEwMDAwMFoiLCJDVkUtMjAyNi01MjcxMCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTEwLTMwVDE4OjA5OjQzLjEwMDAwMFoiLCJDVkUtMjAyNi01MjcxMCJd>. Everything for agents: <https://agentprime.io/llms.txt>.