Cross-site Scripting

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] ParameterCVE-2026-87915danieliser · CVSS 7.2 · 0.5% likely

   CWE-79

2. Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_titleCVE-2026-15797danieliser · CVSS 6.4 · 0.4% likely

   CWE-79

3. Popup Maker – Popup for opt-ins, lead gen, & more <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-2336danieliser · CVSS 6.4 · 0.3% likely

   CWE-79

4. WordPress Popup Maker plugin <= 1.20.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-24746Daniel Iser · CVSS 6.5 · 0.3% likely

   CWE-79

5. Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-10583danieliser · CVSS 5.4 · 0.3% likely

   CWE-79

6. Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-7054danieliser · CVSS 6.4 · 0.3% likely

   CWE-79

7. Popup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID ParameterCVE-2025-4205danieliser · CVSS 6.4 · 0.3% likely

   CWE-79

8. WordPress Content Control plugin <= 2.6.1 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-47501Daniel Iser · CVSS 6.5 · 0.3% likely

   CWE-79

9. Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title ParameterCVE-2025-9490danieliser · CVSS 6.4 · 0.3% likely

   CWE-79

10. WordPress Easy Modal plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-24617Daniel Iser · CVSS 6.5 · 0.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.