Cross-site Scripting

Every one of the 24 is a mark on the map. Named now: 1 to 24, most at risk first.

1. Logo Carousel < 3.4.2 - Contributor+ Stored Cross-Site ScriptingCVE-2021-24738Shapedplugin · 0.6% likely

   CWE-79

2. Location Weather < 1.3.4 - Contributor+ Stored XSSCVE-2023-0360Shapedplugin · CVSS 5.4 · 0.5% likely

   CWE-79

3. WP Tabs < 2.1.17 - Contributor+ Stored XSSCVE-2023-0071Shapedplugin · CVSS 5.4 · 0.5% likely

   CWE-79

4. Product Slider For WooCommerce Lite <= 1.1.7 - Contributor+ Stored XSSCVE-2023-0537Shapedplugin · CVSS 5.4 · 0.5% likely

   CWE-79

5. Post Grid, Post Carousel, & List Category Posts < 2.4.19 - Contributor+ Stored XSSCVE-2023-0097Shapedplugin · CVSS 5.4 · 0.5% likely

   CWE-79

6. Real Testimonials < 2.6.0 - Contributor+ Stored XSSCVE-2022-4648Shapedplugin · CVSS 5.4 · 0.5% likely

   CWE-79

7. Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in ShortcodeCVE-2022-4629Shapedplugin · CVSS 5.4 · 0.5% likely

   CWE-79

8. Easy Accordion – Best Accordion FAQ Plugin for WordPress <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-1363shapedplugin · CVSS 6.4 · 0.4% likely

   CWE-79

9. Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode ChainCVE-2026-120685shapedplugin · CVSS 5.4 · 0.4% likely

   CWE-79

10. Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block AttributeCVE-2026-18988shapedplugin · CVSS 6.4 · 0.3% likely

    CWE-79

11. Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' ParameterCVE-2026-120683shapedplugin · CVSS 5.4 · 0.3% likely

    CWE-79

12. Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Con…CVE-2024-2949shapedplugin · CVSS 6.4 · 0.3% likely

    CWE-79

13. WordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-32801ShapedPlugin · CVSS 5.9 · 0.3% likely

    CWE-79

14. Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block AttributeCVE-2026-15652shapedplugin · CVSS 6.4 · 0.3% likely

    CWE-79

15. Post Grid, Post Carousel, & List Category Posts < 2.4.28 - Editor+ Stored XSSCVE-2024-3996Shapedplugin · CVSS 3.5 · 0.3% likely

    CWE-79

16. Smart Post Show <= 3.0.0 - Editor+ Stored XSSCVE-2024-8187Shapedplugin · CVSS 4.8 · 0.3% likely

    CWE-79

17. Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' ParameterCVE-2026-120509shapedplugin · CVSS 4.7 · 0.3% likely

    CWE-79

18. WordPress WP Tabs Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)CVE-2023-52124ShapedPlugin LLC · CVSS 6.5 · 0.3% likely

    CWE-79

19. WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' AttributeCVE-2026-4665shapedplugin · CVSS 6.4 · 0.3% likely

    CWE-79

20. WordPress Real Testimonials plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-22269ShapedPlugin LLC · CVSS 6.5 · 0.3% likely

    CWE-79

21. WP Tabs < 2.2.7 - Admin+ Stored XSSCVE-2024-11503Shapedplugin · CVSS 6.1 · 0.3% likely

    CWE-79

22. Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter blockCVE-2026-119160shapedplugin · CVSS 6.4 · 0.2% likely

    CWE-79

23. WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-66433ShapedPlugin LLC · CVSS 6.5 · 0.2% likely

    CWE-79

24. WordPress Quick View for WooCommerce Plugin <= 2.2.16 - Cross Site Scripting (XSS) VulnerabilityCVE-2025-58228ShapedPlugin LLC · CVSS 6.5 · 0.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.