I'd suggest that trying to apply numeric values to abstract constructs like "risk", "impact" and "likelihood" isn't likely to be a great idea.
The problem is that each of these terms tends to be both subjective (what's likely to one person isn't likely to another) and extremely situational (the impact of XSS on one site will be likely different to another), so realistically there's very limited use in doing it (apart from to appease management who insist on quantification and ranking of things)
You can see loads of examples of these kinds of problems where people try to quantify vulnerabilities. A good example with CVSS is this.
Having an open telnet port (an entirely unencrypted service) is CVSS 4 according to Rapid7 or perhaps 5.8 if you listen to Tenable , so obviously subjective as it's the same issue. Then for added fun you can compare to having a self-signed certificate, which whilst not always ideal, is better than no encryption at all, but Tenable rate this as CVSS 6.4 , so higher severity than no encryption at all ! (Rapid7 has this one as 4)
Given that people can't even agree on consistent ratings for identical findings, I'd recommend against trying to rank things like XSS which have a much greater variety to them.