Cross-site Scripting

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. Advanced Product Labels for WooCommerce < 1.2.3.7 - Reflected Cross-Site ScriptingCVE-2022-0399Berocket · 0.9% likely

   CWE-79

2. Advanced AJAX Product Filters < 1.5.4.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)CVE-2021-24432Berocket · CVSS 6.1 · 0.4% likely

   CWE-79

3. WordPress Brands for WooCommerce Plugin <= 3.7.0.6 is vulnerable to Cross Site Scripting (XSS)CVE-2023-23667BeRocket · CVSS 6.5 · 0.4% likely

   CWE-79

4. Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode AttributeCVE-2026-15794berocket · CVSS 6.4 · 0.3% likely

   CWE-79

5. Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode AttributeCVE-2026-15648berocket · CVSS 6.4 · 0.3% likely

   CWE-79

6. Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode AttributeCVE-2026-15646berocket · CVSS 6.4 · 0.3% likely

   CWE-79

7. Brands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta FieldCVE-2026-15647berocket · CVSS 4.4 · 0.3% likely

   CWE-79

8. Advanced AJAX Product Filters <= 1.6.8.1 - Reflected Cross-Site ScriptingCVE-2025-1505berocket · CVSS 6.1 · 0.3% likely

   CWE-79

9. Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array KeysCVE-2026-104727berocket · CVSS 6.4 · 0.3% likely

   CWE-79

10. WordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-66439BeRocket · CVSS 7.1 · 0.3% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.