Access Control

Every one of the 44 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Eventin <= 4.0.26 - Privilege EscalationCVE-2025-47539Arraytics · CVSS 9.8 · 25% likely

   CWE-266

2. Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap FilterCVE-2026-75983arraytics · CVSS 7.5 · 0.7% likely

   CWE-269

3. WordPress Eventin plugin <= 3.3.52 - Authenticated Notice Dismissal VulnerabilityCVE-2023-49756Arraytics · CVSS 5.4 · 0.6% likely

   CWE-862

4. Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Authorization to Limited Privilege EscalationCVE-2024-1094arraytics · CVSS 7.3 · 0.5% likely

   CWE-862

5. WordPress Timetics plugin <= 1.0.23 - Broken Access Control vulnerabilityCVE-2024-43923Arraytics · CVSS 5.3 · 0.5% likely

   CWE-862

6. WordPress WPCafe plugin <= 2.2.22 - Broken Access Control vulnerabilityCVE-2023-47805Arraytics · CVSS 5.3 · 0.5% likely

   CWE-862

7. Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events ExportCVE-2024-1122arraytics · CVSS 5.3 · 0.5% likely

   CWE-862

8. WordPress Timetics plugin <= 1.0.29 - Broken Access Control vulnerabilityCVE-2025-30828Arraytics · CVSS 5.3 · 0.5% likely

   CWE-862

9. WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerabilityCVE-2026-40776Arraytics · CVSS 7.5 · 0.4% likely

   CWE-862

10. Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' ParameterCVE-2026-12956arraytics · CVSS 5.3 · 0.4% likely

    CWE-862

11. WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST APICVE-2026-11818arraytics · CVSS 5.4 · 0.4% likely

    CWE-862

12. Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing AuthorizationCVE-2026-11446arraytics · CVSS 5.3 · 0.4% likely

    CWE-862

13. Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status UpdateCVE-2025-1766arraytics · CVSS 5.3 · 0.4% likely

    CWE-862

14. Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data ImportCVE-2024-6033arraytics · CVSS 4.3 · 0.4% likely

    CWE-862

15. WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/DeleteCVE-2026-11601arraytics · CVSS 5.3 · 0.4% likely

    CWE-862

16. Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST APICVE-2026-13039arraytics · CVSS 5.3 · 0.4% likely

    CWE-862

17. WordPress Timetics plugin <= 1.0.44 - Broken Access Control vulnerabilityCVE-2025-64268Arraytics · CVSS 7.5 · 0.3% likely

    CWE-862

18. Eventin <= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' ParameterCVE-2026-109994arraytics · CVSS 6.5 · 0.3% likely

    CWE-862

19. WordPress Timetics plugin <= 1.0.21 - Broken Access Control vulnerabilityCVE-2024-37427Arraytics · CVSS 5.3 · 0.3% likely

    CWE-862

20. Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via…CVE-2025-14657arraytics · CVSS 7.2 · 0.3% likely

    CWE-862

21. WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerabilityCVE-2026-84215Arraytics · CVSS 6.5 · 0.3% likely

    CWE-862

22. WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerabilityCVE-2026-82223Arraytics · CVSS 6.5 · 0.3% likely

    CWE-862

23. Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API EndpointCVE-2026-11821arraytics · CVSS 5.4 · 0.3% likely

    CWE-862

24. WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerabilityCVE-2026-28173Arraytics · CVSS 7.1 · 0.3% likely

    CWE-862

25. WordPress WPCafe plugin <= 3.0.7 - Broken Access Control vulnerabilityCVE-2026-27071Arraytics · CVSS 9.1 · 0.3% likely

    CWE-862

26. WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerabilityCVE-2026-62135Arraytics · CVSS 5.3 · 0.3% likely

    CWE-862

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.