Cross-site Scripting

Every one of the 11 is a mark on the map. Named now: 1 to 11, most at risk first.

1. Locatoraid Store Locator <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2023-2031plainware · CVSS 5.4 · 0.5% likely

   CWE-79

2. Locatoraid Store Locator < 3.9.24 - Reflected XSSCVE-2023-4476Plainware · CVSS 6.1 · 0.5% likely

   CWE-79

3. ShiftController Employee Shift Scheduling <= 4.9.25 - Reflected Cross-Site Scripting via Query StringCVE-2023-1978plainware · CVSS 6.1 · 0.4% likely

   CWE-79

4. WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Scripting (XSS)CVE-2023-29424Plainware · CVSS 7.1 · 0.4% likely

   CWE-79

5. Locatoraid Store Locator <= 3.9.47 - Reflected Cross-Site ScriptingCVE-2024-9652plainware · CVSS 6.1 · 0.4% likely

   CWE-79

6. ShiftController Employee Shift Scheduling <= 4.9.66 - Reflected Cross-Site ScriptingCVE-2024-9435plainware · CVSS 6.1 · 0.4% likely

   CWE-79

7. WordPress Locatoraid Store Locator Plugin <= 3.9.18 is vulnerable to Cross Site Scripting (XSS)CVE-2023-32576Plainware · CVSS 6.5 · 0.4% likely

   CWE-79

8. WordPress Locatoraid Store Locator plugin <= 3.9.30 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-30181Plainware · CVSS 5.9 · 0.4% likely

   CWE-79

9. WordPress PlainInventory plugin <= 3.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2025-24557plainware · CVSS 7.1 · 0.3% likely

   CWE-79

10. WordPress ShiftController Employee Shift Scheduling plugin <= 4.9.64 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-44040plainware · CVSS 5.9 · 0.3% likely

    CWE-79

11. WordPress Locatoraid Store Locator plugin <= 3.9.68 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-62140plainware · CVSS 5.9 · 0.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.