agentprime: Cross-site scripting (XSS)Every new Cross-site scripting (XSS) Advisory and CVE.https://agentprime.io/CVE-2026-88986: Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responseshttps://agentprime.io/advisories/CVE-2026-88986/https://agentprime.io/advisories/CVE-2026-88986/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 22:08:32 GMTCVECVE-2026-110802: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandboxhttps://agentprime.io/advisories/CVE-2026-110802/https://agentprime.io/advisories/CVE-2026-110802/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:41:52 GMTCVECVE-2026-103935: OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attributehttps://agentprime.io/advisories/CVE-2026-103935/https://agentprime.io/advisories/CVE-2026-103935/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:59:37 GMTCVECVE-2026-76580: Cross-site scripting in OpenText Directory Services (OTDS)https://agentprime.io/advisories/CVE-2026-76580/https://agentprime.io/advisories/CVE-2026-76580/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:40:31 GMTCVECVE-2026-107903: Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0https://agentprime.io/advisories/CVE-2026-107903/https://agentprime.io/advisories/CVE-2026-107903/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:56:53 GMTCVECVE-2026-105607: Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0https://agentprime.io/advisories/CVE-2026-105607/https://agentprime.io/advisories/CVE-2026-105607/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:51:43 GMTCVECVE-2026-115452: Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6https://agentprime.io/advisories/CVE-2026-115452/https://agentprime.io/advisories/CVE-2026-115452/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:51:21 GMTCVECVE-2026-75599: HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fieldshttps://agentprime.io/advisories/CVE-2026-75599/https://agentprime.io/advisories/CVE-2026-75599/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:02:37 GMTCVECVE-2026-102615: HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSShttps://agentprime.io/advisories/CVE-2026-102615/https://agentprime.io/advisories/CVE-2026-102615/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:32:30 GMTCVECVE-2026-123094: Huginn before 2026.11.05 Stored XSS via OAuth Service Display Namehttps://agentprime.io/advisories/CVE-2026-123094/https://agentprime.io/advisories/CVE-2026-123094/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:11:49 GMTCVECVE-2026-76563: HTML Injection in Fileorbishttps://agentprime.io/advisories/CVE-2026-76563/https://agentprime.io/advisories/CVE-2026-76563/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:47:15 GMTCVECVE-2026-114229: Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Sessionhttps://agentprime.io/advisories/CVE-2026-114229/https://agentprime.io/advisories/CVE-2026-114229/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:36:15 GMTCVECVE-2026-103863: Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper pathshttps://agentprime.io/advisories/CVE-2026-103863/https://agentprime.io/advisories/CVE-2026-103863/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 12:31:45 GMTCVECVE-2026-96677: Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chromehttps://agentprime.io/advisories/CVE-2026-96677/https://agentprime.io/advisories/CVE-2026-96677/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 11:54:38 GMTCVEcriticalCVE-2026-117679: Cross-site scripting in SHIRASAGIhttps://agentprime.io/advisories/CVE-2026-117679/https://agentprime.io/advisories/CVE-2026-117679/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 08:17:24 GMTCVECVE-2026-120533: Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profilehttps://agentprime.io/advisories/CVE-2026-120533/https://agentprime.io/advisories/CVE-2026-120533/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 04:48:07 GMTCVECVE-2026-104812: Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Keyhttps://agentprime.io/advisories/CVE-2026-104812/https://agentprime.io/advisories/CVE-2026-104812/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 04:48:07 GMTCVECVE-2026-120553: Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attributehttps://agentprime.io/advisories/CVE-2026-120553/https://agentprime.io/advisories/CVE-2026-120553/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 04:48:05 GMTCVECVE-2026-122190: SourceCodester Online Food Ordering System Category Management add_category.php cross site scriptinghttps://agentprime.io/advisories/CVE-2026-122190/https://agentprime.io/advisories/CVE-2026-122190/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 03:15:20 GMTCVECVE-2026-54380: VitaFit Cloud API Stored XSS via SVG File Uploadhttps://agentprime.io/advisories/CVE-2026-54380/https://agentprime.io/advisories/CVE-2026-54380/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 22:10:52 GMTCVECVE-2026-122234: jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formattershttps://agentprime.io/advisories/CVE-2026-122234/https://agentprime.io/advisories/CVE-2026-122234/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 21:06:41 GMTCVECVE-2025-71453: vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockListhttps://agentprime.io/advisories/CVE-2025-71453/https://agentprime.io/advisories/CVE-2025-71453/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:36:42 GMTCVECVE-2026-113369: Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tabhttps://agentprime.io/advisories/CVE-2026-113369/https://agentprime.io/advisories/CVE-2026-113369/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:01:20 GMTCVECVE-2026-102345: Zammad: Stored XSS in ticket article rendering in the new Vue-based interfacehttps://agentprime.io/advisories/CVE-2026-102345/https://agentprime.io/advisories/CVE-2026-102345/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 18:59:57 GMTCVECVE-2026-121929: EmpireSoft EmpireCMS index.php cross site scriptinghttps://agentprime.io/advisories/CVE-2026-121929/https://agentprime.io/advisories/CVE-2026-121929/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 18:15:16 GMTCVECVE-2026-121928: InfiniFlow RAGFlow Images API file_utils.py cross site scriptinghttps://agentprime.io/advisories/CVE-2026-121928/https://agentprime.io/advisories/CVE-2026-121928/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 18:00:30 GMTCVECVE-2026-57853: DataGerry < 3.3.0 SSTI via DocAPI Template Renderinghttps://agentprime.io/advisories/CVE-2026-57853/https://agentprime.io/advisories/CVE-2026-57853/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 17:55:41 GMTCVECVE-2026-76419: Cisco Unified Communications Manager Cross-Site Scripting Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-76419/https://agentprime.io/advisories/CVE-2026-76419/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 16:27:03 GMTCVEodf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute valueshttps://agentprime.io/advisories/GHSA-3cgg-c5pp-57h6/https://agentprime.io/advisories/GHSA-3cgg-c5pp-57h6/odf-kit >=0.6.0, <0.14.2, fixed in 0.14.2. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 04 Nov 2026 16:14:34 GMTnpmodf-kitCVE-2026-120421: Reflected XSS via client window id in URL client window modehttps://agentprime.io/advisories/CVE-2026-120421/https://agentprime.io/advisories/CVE-2026-120421/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 15:12:11 GMTCVECVE-2026-121008: SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profilehttps://agentprime.io/advisories/CVE-2026-121008/https://agentprime.io/advisories/CVE-2026-121008/Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 14:36:13 GMTCVECVE-2026-114627: Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags outputhttps://agentprime.io/advisories/CVE-2026-114627/https://agentprime.io/advisories/CVE-2026-114627/Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 14:31:13 GMTCVECVE-2026-121632: Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escapinghttps://agentprime.io/advisories/CVE-2026-121632/https://agentprime.io/advisories/CVE-2026-121632/Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 14:23:14 GMTCVECVE-2026-119468: WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-119468/https://agentprime.io/advisories/CVE-2026-119468/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 12:08:34 GMTCVECVE-2026-97397: Remove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Bufferhttps://agentprime.io/advisories/CVE-2026-97397/https://agentprime.io/advisories/CVE-2026-97397/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 11:26:22 GMTCVECVE-2026-111040: Multiple vulnerabilities in Coupa’s Total Spend Management Platformhttps://agentprime.io/advisories/CVE-2026-111040/https://agentprime.io/advisories/CVE-2026-111040/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 09:54:08 GMTCVECVE-2026-111037: Multiple vulnerabilities in Coupa’s Total Spend Management Platformhttps://agentprime.io/advisories/CVE-2026-111037/https://agentprime.io/advisories/CVE-2026-111037/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 09:35:57 GMTCVECVE-2026-115498: Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Fieldhttps://agentprime.io/advisories/CVE-2026-115498/https://agentprime.io/advisories/CVE-2026-115498/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 09:26:07 GMTCVECVE-2026-93900: Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeshttps://agentprime.io/advisories/CVE-2026-93900/https://agentprime.io/advisories/CVE-2026-93900/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 09:26:06 GMTCVECVE-2026-57666: WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-57666/https://agentprime.io/advisories/CVE-2026-57666/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 08:00:17 GMTCVECVE-2026-119366: WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-119366/https://agentprime.io/advisories/CVE-2026-119366/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 08:00:17 GMTCVECVE-2026-62007: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-62007/https://agentprime.io/advisories/CVE-2026-62007/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 08:00:17 GMTCVECVE-2026-54861: WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-54861/https://agentprime.io/advisories/CVE-2026-54861/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 08:00:17 GMTCVECVE-2026-57639: WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-57639/https://agentprime.io/advisories/CVE-2026-57639/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 08:00:16 GMTCVECVE-2026-119477: WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-119477/https://agentprime.io/advisories/CVE-2026-119477/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 08:00:16 GMTCVECVE-2026-54851: WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityhttps://agentprime.io/advisories/CVE-2026-54851/https://agentprime.io/advisories/CVE-2026-54851/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 07:00:37 GMTCVECVE-2026-118983: VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blockshttps://agentprime.io/advisories/CVE-2026-118983/https://agentprime.io/advisories/CVE-2026-118983/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 06:00:28 GMTCVECVE-2026-118783: All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attributehttps://agentprime.io/advisories/CVE-2026-118783/https://agentprime.io/advisories/CVE-2026-118783/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 06:00:28 GMTCVECVE-2026-115250: Text Typing < 2.2.2 - Contributor+ Stored XSShttps://agentprime.io/advisories/CVE-2026-115250/https://agentprime.io/advisories/CVE-2026-115250/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 06:00:27 GMTCVECVE-2026-114431: Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Uploadhttps://agentprime.io/advisories/CVE-2026-114431/https://agentprime.io/advisories/CVE-2026-114431/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 06:00:26 GMTCVE