Cross-site Scripting

Every one of the 64 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Easy Twitter Feed < 1.2 - Contributor+ Stored Cross-Site ScriptingCVE-2021-24413Bplugins · 0.7% likely

   CWE-79

2. Html5 Audio Player < 2.1.3 - Contributor+ Stored Cross-Site ScriptingCVE-2021-24412Bplugins · 0.7% likely

   CWE-79

3. StreamCast < 2.1.1 - Contributor+ Stored Cross-Site ScriptingCVE-2021-24416Bplugins · 0.6% likely

   CWE-79

4. Polo Video Gallery <= 1.2 - Contributor+ Stored Cross-Site ScriptingCVE-2021-24415Bplugins · 0.6% likely

   CWE-79

5. Html5 Audio Player < 2.1.12 - Contributor+ Stored XSSCVE-2023-0170Bplugins · CVSS 5.4 · 0.6% likely

   CWE-79

6. Html5 Video Player < 2.5.19 - Subscriber+ Stored XSSCVE-2023-6485Bplugins · CVSS 5.4 · 0.5% likely

   CWE-79

7. HTML5 Audio Player- Best WordPress Audio Player Plugin <= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsCVE-2024-4398bplugins · CVSS 6.4 · 0.5% likely

   CWE-79

8. WordPress B Blocks plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerabilityCVE-2025-32173bPlugins · CVSS 6.5 · 0.4% likely

   CWE-79

9. WordPress All Embed – Elementor Addons plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-24595bPlugins · CVSS 6.5 · 0.4% likely

   CWE-79

10. WordPress Html5 Audio Player plugin <= 2.2.28 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-39524bPlugins · CVSS 6.5 · 0.4% likely

    CWE-80

11. HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading ParameterCVE-2024-13156bplugins · CVSS 6.4 · 0.4% likely

    CWE-79

12. WordPress Print Page block plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-30438bPlugins · CVSS 6.5 · 0.4% likely

    CWE-79

13. WordPress B Slider plugin <= 1.1.12 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-30432bPlugins · CVSS 6.5 · 0.3% likely

    CWE-79

14. WordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)CVE-2024-23508bPlugins · CVSS 7.1 · 0.3% likely

    CWE-79

15. B Testimonial – testimonial plugin for WP <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-11880bplugins · CVSS 6.4 · 0.3% likely

    CWE-79

16. Lottie Player <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File UploadCVE-2025-2579bplugins · CVSS 6.4 · 0.3% likely

    CWE-79

17. FAQ And Answers – Create Frequently Asked Questions Area on WP Sites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-11882bplugins · CVSS 6.4 · 0.3% likely

    CWE-79

18. Alert Box Block – Display notice/alerts in the front end <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Box BlockCVE-2024-13731bplugins · CVSS 6.4 · 0.3% likely

    CWE-79

19. Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network LinkCVE-2026-0833bplugins · CVSS 6.4 · 0.3% likely

    CWE-79

20. WordPress Countdown Timer block plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-26938bPlugins · CVSS 6.5 · 0.3% likely

    CWE-79

21. WordPress StreamCast <= 2.2.3 - Stored Cross Site Scripting (XSS) vulnerabilityCVE-2024-43148bPlugins · CVSS 5.9 · 0.3% likely

    CWE-79

22. WordPress Team Section Block plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-26949bPlugins · CVSS 6.5 · 0.3% likely

    CWE-79

23. WordPress Services Section block plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-26947bPlugins · CVSS 6.5 · 0.3% likely

    CWE-79

24. WordPress Sticky Content plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-26881bPlugins · CVSS 6.5 · 0.3% likely

    CWE-79

25. WordPress HTML5 Audio Player plugin <= 2.2.23 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-37445bPlugins · CVSS 6.5 · 0.3% likely

    CWE-79

26. WordPress Business Card Block plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-26952bPlugins · CVSS 6.5 · 0.3% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.