# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Typemill SvgSanitizer.php saveImage cross site scripting](https://agentprime.io/advisories/CVE-2026-120218.md)
  `CVE-2026-120218` · CVE record: Typemill · CVSS 5.1 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-113482.md)
  `CVE-2026-113482` · CVE record: Unknown Media Library Assistant · CVSS 6.8 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads](https://agentprime.io/advisories/CVE-2026-120248.md)
  `CVE-2026-120248` · CVE record: Thelia Thelia and 2 more · CVSS 4.6 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS)
- [PostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scripting](https://agentprime.io/advisories/CVE-2026-120190.md)
  `CVE-2026-120190` · CVE record: PostyBirb Plus · CVSS 5.1 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name](https://agentprime.io/advisories/CVE-2026-120205.md)
  `CVE-2026-120205` · CVE record: Thelia Thelia and 1 more · CVSS 7.4 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting](https://agentprime.io/advisories/CVE-2026-78190.md)
  `CVE-2026-78190` · CVE record · No CVSS score · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '\<fieldname>\_start' / '\<fieldname>\_end' Parameter](https://agentprime.io/advisories/CVE-2026-104926.md)
  `CVE-2026-104926` · CVE record: ThemeHigh WooCommerce Extra Product Options Pro · CVSS 6.1 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint](https://agentprime.io/advisories/CVE-2026-107711.md)
  `CVE-2026-107711` · CVE record: wppool FlexStock – Product Stock Sync with Google Sheets for WooCommerce · CVSS 6.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint](https://agentprime.io/advisories/CVE-2026-120114.md)
  `CVE-2026-120114` · CVE record: qriouslad Debug Log Manager – Conveniently Monitor and Inspect Errors · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:\<key>' URL Parameter](https://agentprime.io/advisories/CVE-2026-100151.md)
  `CVE-2026-100151` · CVE record: kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder · CVSS 6.1 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name](https://agentprime.io/advisories/CVE-2026-96554.md)
  `CVE-2026-96554` · CVE record: Boss Media BuddyBoss Platform · CVSS 6.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection](https://agentprime.io/advisories/CVE-2026-116752.md)
  `CVE-2026-116752` · CVE record: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · CVSS 6.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content](https://agentprime.io/advisories/CVE-2026-110530.md)
  `CVE-2026-110530` · CVE record: radgeek FeedWordPress · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-120075.md)
  `CVE-2026-120075` · CVE record: melapress WP Activity Log · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block](https://agentprime.io/advisories/CVE-2026-119160.md)
  `CVE-2026-119160` · CVE record: shapedplugin Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News · CVSS 6.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article \`\<meta name="description">\`](https://agentprime.io/advisories/CVE-2026-111070.md)
  `CVE-2026-111070` · CVE record: pluginever Content Pilot – Autoblogging & Affiliate Marketing Suite · CVSS 5.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail](https://agentprime.io/advisories/CVE-2026-107759.md)
  `CVE-2026-107759` · CVE record: wpo365 WPO365 | MICROSOFT 365 GRAPH MAILER · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr\[required\]' Parameter](https://agentprime.io/advisories/CVE-2026-103962.md)
  `CVE-2026-103962` · CVE record: wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission · CVSS 6.1 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag](https://agentprime.io/advisories/CVE-2026-116535.md)
  `CVE-2026-116535` · CVE record: rainbowgeek SEOPress – AI SEO Plugin & On-site SEO · CVSS 6.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log](https://agentprime.io/advisories/CVE-2026-118057.md)
  `CVE-2026-118057` · CVE record: paultgoodchild Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author…](https://agentprime.io/advisories/CVE-2026-111592.md)
  `CVE-2026-111592` · CVE record: publishpress Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors · CVSS 6.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter](https://agentprime.io/advisories/CVE-2026-119065.md)
  `CVE-2026-119065` · CVE record: arosoft Shipping Zones by Drawing for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter](https://agentprime.io/advisories/CVE-2026-116548.md)
  `CVE-2026-116548` · CVE record: e4jvikwp VikRentCar Car Rental Management System · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter](https://agentprime.io/advisories/CVE-2026-118070.md)
  `CVE-2026-118070` · CVE record: uscnanbu Welcart e-Commerce · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter](https://agentprime.io/advisories/CVE-2026-115840.md)
  `CVE-2026-115840` · CVE record: e4jvikwp VikRentCar Car Rental Management System · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout](https://agentprime.io/advisories/CVE-2026-107750.md)
  `CVE-2026-107750` · CVE record: wpovernight PDF Invoices & Packing Slips for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter](https://agentprime.io/advisories/CVE-2026-88942.md)
  `CVE-2026-88942` · CVE record: woobewoo Product Filter for WooCommerce by WBW · CVSS 6.1 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting](https://agentprime.io/advisories/CVE-2026-119162.md)
  `CVE-2026-119162` · CVE record: specialk User Submitted Posts – Enable Users to Submit Posts from the Front End · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field](https://agentprime.io/advisories/CVE-2026-107765.md)
  `CVE-2026-107765` · CVE record: marketingfire Discussion Board – WordPress Forum Plugin · CVSS 6.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WP Job Portal <= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter](https://agentprime.io/advisories/CVE-2026-116546.md)
  `CVE-2026-116546` · CVE record: wpjobportal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website · CVSS 6.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode](https://agentprime.io/advisories/CVE-2026-116522.md)
  `CVE-2026-116522` · CVE record: comesio Relevanssi – A Better Search · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via \<ta> Tag](https://agentprime.io/advisories/CVE-2026-119089.md)
  `CVE-2026-119089` · CVE record: supercleanse ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder](https://agentprime.io/advisories/CVE-2026-120019.md)
  `CVE-2026-120019` · CVE record: boldgrid W3 Total Cache · CVSS 5.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments](https://agentprime.io/advisories/CVE-2026-107653.md)
  `CVE-2026-107653` · CVE record: surecart SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag](https://agentprime.io/advisories/CVE-2026-111109.md)
  `CVE-2026-111109` · CVE record: pfefferle Webmention · CVSS 6.1 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry](https://agentprime.io/advisories/CVE-2026-111254.md)
  `CVE-2026-111254` · CVE record: boldgrid W3 Total Cache · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute](https://agentprime.io/advisories/CVE-2026-118438.md)
  `CVE-2026-118438` · CVE record: Unknown Firelight Lightbox · CVSS 6.8 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '\[ppwp\]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision](https://agentprime.io/advisories/CVE-2026-116520.md)
  `CVE-2026-116520` · CVE record: buildwps PPWP – Password Protect Pages · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization](https://agentprime.io/advisories/CVE-2026-109997.md)
  `CVE-2026-109997` · CVE record: kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization](https://agentprime.io/advisories/CVE-2026-109234.md)
  `CVE-2026-109234` · CVE record: tigroumeow Meow Lightbox · CVSS 7.2 High · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment \`title\` Attribute via Shutter Lightbox innerHTML](https://agentprime.io/advisories/CVE-2026-116563.md)
  `CVE-2026-116563` · CVE record: smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery · CVSS 5.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Cross-site scripting (XSS)
- [AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)](https://agentprime.io/advisories/GHSA-rx7m-wxwq-vxr9.md)
  `GHSA-rx7m-wxwq-vxr9`, `CVE-2026-96632`, `PKSA-jqcq-6phr-785g` · Packagist `adminneo-org/adminneo`: affected `<5.5.1`, fixed in `5.5.1` · CVSS 4.0, no score published · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields](https://agentprime.io/advisories/CVE-2026-111578.md)
  `CVE-2026-111578` · CVE record: Unknown PDF Invoices & Packing Slips for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation](https://agentprime.io/advisories/CVE-2026-62990.md)
  `CVE-2026-62990` · CVE record: shopperlabs shopper · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS), Privilege escalation
- [Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1](https://agentprime.io/advisories/EEF-CVE-2026-117645.md)
  `EEF-CVE-2026-117645`, `CVE-2026-117645` · Hex `phoenix_html`: affected `>=1.0.0, <3.3.5 || >=4.0.0, <4.4.0`, fixed in `3.3.5`, `4.4.0` · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter](https://agentprime.io/advisories/CVE-2026-7004.md)
  `CVE-2026-7004` · CVE record: WIT SynApps Runtime · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116854.md)
  `CVE-2026-116854` · CVE record: Aguila Technologies WP Customer Area · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116851.md)
  `CVE-2026-116851` · CVE record: impleCode eCommerce Product Catalog · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116847.md)
  `CVE-2026-116847` · CVE record: Kitae Park Mang Board WP · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-116405.md)
  `CVE-2026-116405` · CVE record: e4jvikwp VikRentCar · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114711.md)
  `CVE-2026-114711` · CVE record: MultiVendorX MultiVendorX · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-105077.md)
  `CVE-2026-105077` · CVE record: Spacetime Ad Inserter · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-94175.md)
  `CVE-2026-94175` · CVE record: Saad Iqbal All In One Login · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-54855.md)
  `CVE-2026-54855` · CVE record: Cozmoslabs Profile Builder · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-48201.md)
  `CVE-2026-48201` · CVE record: Raul P. Fast Velocity Minify · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-39786.md)
  `CVE-2026-39786` · CVE record: bookingalgorithms BA Book Everything · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-28160.md)
  `CVE-2026-28160` · CVE record: e4jvikwp VikRentCar · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-27061.md)
  `CVE-2026-27061` · CVE record: wpeverest User Registration · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-39739.md)
  `CVE-2026-39739` · CVE record: Brainstorm Force Ultimate Addons for Elementor - Lite · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WordPress GIFTiT \&#8211; Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-52710.md)
  `CVE-2026-52710` · CVE record: ithemelandco GIFTiT \&#8211; Free Gifts for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTEwLTMwVDE4OjA5OjQzLjEwMDAwMFoiLCJDVkUtMjAyNi01MjcxMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTExLTAxVDA5OjQ4OjMyLjIwNjAwMFoiLCJDVkUtMjAyNi0xMTM0MjkiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTExLTAxVDA5OjQ4OjMyLjIwNjAwMFoiLCJDVkUtMjAyNi0xMTM0MjkiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.