Cross-site Scripting

Every one of the 32 is a mark on the map. Named now: 1 to 26, most at risk first.

1. ShopLentor <= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner LinkCVE-2024-1960devitemsllc · CVSS 6.4 · 0.5% likely

   CWE-79

2. HT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTagCVE-2024-1397devitemsllc · CVSS 6.4 · 0.5% likely

   CWE-79

3. ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripti…CVE-2024-2868devitemsllc · CVSS 6.4 · 0.5% likely

   CWE-79

4. HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover WidgetCVE-2024-3990devitemsllc · CVSS 6.4 · 0.4% likely

   CWE-79

5. ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripti…CVE-2024-3991devitemsllc · CVSS 6.4 · 0.4% likely

   CWE-79

6. HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid WidgetCVE-2024-3308devitemsllc · CVSS 6.4 · 0.4% likely

   CWE-79

7. HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsCVE-2024-5215devitemsllc · CVSS 6.4 · 0.4% likely

   CWE-79

8. ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Si…CVE-2024-8668devitemsllc · CVSS 6.4 · 0.4% likely

   CWE-79

9. ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripti…CVE-2024-5530devitemsllc · CVSS 6.4 · 0.4% likely

   CWE-79

10. ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter NameCVE-2026-92554devitemsllc · CVSS 6.1 · 0.4% likely

    CWE-79

11. HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-4876devitemsllc · CVSS 6.4 · 0.4% likely

    CWE-79

12. ShopLentor <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch ShortcodeCVE-2024-3345devitemsllc · CVSS 6.4 · 0.4% likely

    CWE-79

13. HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery JustifyCVE-2024-3989devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

14. ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripti…CVE-2024-2946devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

15. HT Mega – Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetCVE-2024-12599devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

16. HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_cssCVE-2024-12597devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

17. HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetCVE-2024-3307devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

18. HT Mega – Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQCVE-2024-2790devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

19. HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'CVE-2024-2085devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

20. HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox WidgetCVE-2024-2084devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

21. HT Mega – Absolute Addons For Elementor <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel WidgetCVE-2024-1421devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

22. ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripti…CVE-2024-1057devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

23. ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode AttributeCVE-2026-4059devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

24. HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsCVE-2025-1802devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

25. HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM SinkCVE-2026-111318devitemsllc · CVSS 5.4 · 0.3% likely

    CWE-79

26. HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget SettingsCVE-2024-5173devitemsllc · CVSS 6.4 · 0.3% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.