# Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Cross-site scripting in Dell Wyse Management Suite](https://agentprime.io/advisories/CVE-2026-82161.md)
  `CVE-2026-82161` · CVE record: Dell Wyse Management Suite · CVSS 6.8 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Dell Wyse Management Suite](https://agentprime.io/advisories/CVE-2026-82158.md)
  `CVE-2026-82158` · CVE record: Dell Wyse Management Suite · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Dell Wyse Management Suite](https://agentprime.io/advisories/CVE-2026-82159.md)
  `CVE-2026-82159` · CVE record: Dell Wyse Management Suite · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp](https://agentprime.io/advisories/CVE-2025-71452.md)
  `CVE-2025-71452` · CVE record: Vembu Technologies BDRSuite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp](https://agentprime.io/advisories/CVE-2025-71451.md)
  `CVE-2025-71451` · CVE record: Vembu Technologies BDRSuite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering](https://agentprime.io/advisories/CVE-2026-121652.md)
  `CVE-2026-121652` · CVE record: AWS maplibre-gl-js-amplify · CVSS 4.8 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [traQ: XSS in the User Uploaded File Retrieval API](https://agentprime.io/advisories/CVE-2026-63197.md)
  `CVE-2026-63197` · CVE record: traPtitech traQ · CVSS 7.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered \`.constructor\` member access](https://agentprime.io/advisories/GHSA-33r5-xmm8-v6x5.md)
  `GHSA-33r5-xmm8-v6x5`, `CVE-2026-44267` · npm `@enspirit/elo`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-693
- [buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL](https://agentprime.io/advisories/CVE-2026-121627.md)
  `CVE-2026-121627` · CVE record: jarun buku · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-114185.md)
  `CVE-2026-114185` · CVE record: WPVibes AnyWhere Elementor · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-120843.md)
  `CVE-2026-120843` · CVE record: Barn2 Plugins Posts Table with Search & Sort · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116858.md)
  `CVE-2026-116858` · CVE record: WPMU DEV Forminator · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-119521.md)
  `CVE-2026-119521` · CVE record: Cozmoslabs Paid Member Subscriptions · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [TeXlyre from 0.11.0 before 0.13.5 Stored XSS via Recipe Icon Import](https://agentprime.io/advisories/CVE-2026-121588.md)
  `CVE-2026-121588` · CVE record: TeXlyre texlyre · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [CVE-2026-121578](https://agentprime.io/advisories/CVE-2026-121578.md)
  `CVE-2026-121578` · CVE record: Amidaware Tactical RMM · CVSS 6.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description](https://agentprime.io/advisories/CVE-2026-121551.md)
  `CVE-2026-121551` · CVE record: postfixadmin postfixadmin · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [svg-sanitizer before 1.1.0 XSS via animateTransform on Safari](https://agentprime.io/advisories/CVE-2026-121447.md)
  `CVE-2026-121447` · CVE record: darylldoyle svg-sanitizer · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.](https://agentprime.io/advisories/CVE-2026-108060.md)
  `CVE-2026-108060` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.](https://agentprime.io/advisories/CVE-2026-108059.md)
  `CVE-2026-108059` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.](https://agentprime.io/advisories/CVE-2026-108058.md)
  `CVE-2026-108058` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.](https://agentprime.io/advisories/CVE-2026-108057.md)
  `CVE-2026-108057` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.](https://agentprime.io/advisories/CVE-2026-108056.md)
  `CVE-2026-108056` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.](https://agentprime.io/advisories/CVE-2026-108055.md)
  `CVE-2026-108055` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.](https://agentprime.io/advisories/CVE-2026-108054.md)
  `CVE-2026-108054` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.](https://agentprime.io/advisories/CVE-2026-108053.md)
  `CVE-2026-108053` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.](https://agentprime.io/advisories/CVE-2026-108052.md)
  `CVE-2026-108052` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.](https://agentprime.io/advisories/CVE-2026-108051.md)
  `CVE-2026-108051` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.](https://agentprime.io/advisories/CVE-2026-108050.md)
  `CVE-2026-108050` · CVE record: AM System ALO Suite · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [TYPO3-EXT-SA-2026-037: Cross-Site Scripting in extension "Mail" (mail)](https://agentprime.io/advisories/PKSA-t76y-hqn1-zzxw.md)
  `PKSA-t76y-hqn1-zzxw`, `CVE-2026-120332` · Packagist `mediaessenz/mail`: affected `<3.12.5 || >=4.0.0, <4.2.0`, fixed in `3.12.5`, `4.2.0` · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in NAVER billboard.js](https://agentprime.io/advisories/CVE-2026-120988.md)
  `CVE-2026-120988` · CVE record: NAVER billboard.js · CVSS 6.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification](https://agentprime.io/advisories/CVE-2025-5769.md)
  `CVE-2025-5769` · CVE record: WSO2 WSO2 API Control Plane and 2 more · CVSS 6.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name](https://agentprime.io/advisories/CVE-2026-120575.md)
  `CVE-2026-120575` · CVE record: tigroumeow Photo Engine (Media Organizer & Lightroom) · CVSS 6.4 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action](https://agentprime.io/advisories/CVE-2026-120524.md)
  `CVE-2026-120524` · CVE record: blazethemes News Kit Addons For Elementor · CVSS 6.4 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()](https://agentprime.io/advisories/CVE-2026-120552.md)
  `CVE-2026-120552` · CVE record: tigroumeow SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress · CVSS 6.4 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting](https://agentprime.io/advisories/CVE-2026-120597.md)
  `CVE-2026-120597` · CVE record: Welcart e-Commerce Plugin · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows](https://agentprime.io/advisories/CVE-2026-120497.md)
  `CVE-2026-120497` · CVE record: AWS aidlc-traceability · CVSS 4.6 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Munshi XSS via Purchase Inquiry Thread Rendering](https://agentprime.io/advisories/CVE-2026-119735.md)
  `CVE-2026-119735` · CVE record: Petpooja Munshi · CVSS 5.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes](https://agentprime.io/advisories/CVE-2026-111048.md)
  `CVE-2026-111048` · CVE record: FOSSBilling FOSSBilling · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [An Otter Wiki before 2.26.2 Stored XSS via Math Code Block](https://agentprime.io/advisories/CVE-2026-120500.md)
  `CVE-2026-120500` · CVE record: redimp otterwiki · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [XSS in wrensec-commons CREST framework HTTP binding via \_mimeType parameter](https://agentprime.io/advisories/CVE-2026-2102.md)
  `CVE-2026-2102` · CVE record: Wren Security wrensec-commons · CVSS 6.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page](https://agentprime.io/advisories/CVE-2026-120491.md)
  `CVE-2026-120491` · CVE record: Wing FTP Software Wing FTP Server · CVSS 5.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content](https://agentprime.io/advisories/CVE-2026-120488.md)
  `CVE-2026-120488` · CVE record: LaraDashboard LaraDashboard · CVSS 5.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results](https://agentprime.io/advisories/CVE-2026-120443.md)
  `CVE-2026-120443` · CVE record: sea-team GoFound · CVSS 5.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass](https://agentprime.io/advisories/CVE-2026-120428.md)
  `CVE-2026-120428` · CVE record: Chaitin PandaWiki · CVSS 5.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.](https://agentprime.io/advisories/CVE-2026-103419.md)
  `CVE-2026-103419` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5](https://agentprime.io/advisories/CVE-2026-105601.md)
  `CVE-2026-105601` · CVE record: php-web-design.com StageIt extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.](https://agentprime.io/advisories/CVE-2026-105602.md)
  `CVE-2026-105602` · CVE record: joomshaper.com Helix Ultimate extension for Joomla · CVSS 8.6 High · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-91907.md)
  `CVE-2026-91907` · CVE record: Dell OpenManage Enterprise · CVSS 6.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting in Multiple WSO2 Products](https://agentprime.io/advisories/CVE-2025-12544.md)
  `CVE-2025-12544` · CVE record: WSO2 WSO2 API Manager and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products](https://agentprime.io/advisories/CVE-2024-7075.md)
  `CVE-2024-7075` · CVE record: WSO2 WSO2 Enterprise Integrator and 3 more · CVSS 4.6 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [mathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting](https://agentprime.io/advisories/CVE-2026-120343.md)
  `CVE-2026-120343` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection
- [mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php cross site scripting](https://agentprime.io/advisories/CVE-2026-120339.md)
  `CVE-2026-120339` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup](https://agentprime.io/advisories/CVE-2026-111089.md)
  `CVE-2026-111089` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.6 High · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup](https://agentprime.io/advisories/CVE-2026-95863.md)
  `CVE-2026-95863` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.6 High · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag](https://agentprime.io/advisories/CVE-2026-84231.md)
  `CVE-2026-84231` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.4 High · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data](https://agentprime.io/advisories/CVE-2026-83539.md)
  `CVE-2026-83539` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.4 High · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name](https://agentprime.io/advisories/CVE-2026-82956.md)
  `CVE-2026-82956` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.6 High · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting](https://agentprime.io/advisories/CVE-2026-120242.md)
  `CVE-2026-120242` · CVE record: Ruijie RG-ES205GC and 4 more · CVSS 4.8 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection
- [WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/CVE-2026-66570.md)
  `CVE-2026-66570` · CVE record: Nickboss WordPress File Upload · CVSS 7.1 High · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Gitea stored XSS through legacy Actions artifact Content-Encoding](https://agentprime.io/advisories/CVE-2026-113429.md)
  `CVE-2026-113429` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/tag/xss.md>
Older: <https://agentprime.io/advisories/tag/xss.md?cursor=WyIyMDI2LTExLTAxVDA5OjQ4OjMyLjIwNjAwMFoiLCJDVkUtMjAyNi0xMTM0MjkiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xss&cursor=WyIyMDI2LTExLTAzVDIwOjU2OjIzLjY2ODAwMFoiLCJDVkUtMjAyNi04MjE2MCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xss/?cursor=WyIyMDI2LTExLTAzVDIwOjU2OjIzLjY2ODAwMFoiLCJDVkUtMjAyNi04MjE2MCJd>. Everything for agents: <https://agentprime.io/llms.txt>.