Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

1. WordPress Contact Form by Supsystic plugin <= 1.7.28 - Remote Code Execution (RCE) vulnerabilityCVE-2024-48042supsystic · CVSS 9.1 · 1.1% likely

   Supsystic

2. WordPress Popup by Supsystic plugin <= 1.10.29 - Remote Code Execution (RCE) vulnerabilityCVE-2024-52434supsystic · CVSS 9.1 · 1.1% likely

   Supsystic

3. WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.121 - Remote Code Execution (RCE) vulnerabilityCVE-2024-49271Unlimited Elements · CVSS 9.1 · 1.1% likely

   Unlimited Elements

4. WordPress Event Tickets with Ticket Scanner plugin <= 2.3.11 - Remote Code Execution (RCE) vulnerabilityCVE-2024-52427Vollstart · CVSS 9.9 · 0.7% likely
5. WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerabilityCVE-2024-52393Eric Teubert · CVSS 9.1 · 0.5% likely

   Eric Teubert

6. Zammad: Improper neutralization of `srcset` attribute in IMG tags in ZammadCVE-2026-56735zammad · CVSS 5.3 · 0.4% likely

   Zammad

7. WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) VulnerabilityCVE-2025-53194Crocoblock · CVSS 8.5 · 0.4% likely

   Crocoblock

8. Stored XSS in Foundry Slate Query Dropdown menuCVE-2023-30963Palantir · CVSS 5.4 · 0.4% likely

   Palantir

9. OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG EditorCVE-2023-54423OpenMage · CVSS 7.5

   OpenMage

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.