File and Path Handling

Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.

1. WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File DownloadCVE-2025-47445Arraytics · CVSS 7.5 · 5.2% likely

   CWE-23

2. Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' ParameterCVE-2026-15406arraytics · CVSS 7.5 · 1.1% likely

   CWE-98

3. WordPress WPCafe plugin <= 2.2.31 - Local File Inclusion vulnerabilityCVE-2025-30829Arraytics · CVSS 7.5 · 1.1% likely

   CWE-98

4. Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File InclusionCVE-2024-7149arraytics · CVSS 8.8 · 1.0% likely

   CWE-22

5. Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' ParameterCVE-2026-15667arraytics · CVSS 7.5 · 1.0% likely

   CWE-98

6. WordPress Eventin plugin <= 4.0.25 - Local File Inclusion VulnerabilityCVE-2025-39584Arraytics · CVSS 7.5 · 0.9% likely

   CWE-98

7. Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File InclusionCVE-2025-1770arraytics · CVSS 8.8 · 0.9% likely

   CWE-22

8. WordPress WPCafe plugin <= 2.2.32 - Local File Inclusion vulnerabilityCVE-2025-39452Arraytics · CVSS 7.5 · 0.8% likely

   CWE-98

9. WordPress Eventin plugin <= 4.0.20 - Local File Inclusion vulnerabilityCVE-2025-26964Arraytics · CVSS 7.5 · 0.8% likely

   CWE-98

10. Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File ReadCVE-2025-3419arraytics · CVSS 7.5 · 0.7% likely

    CWE-73

11. WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget SettingCVE-2026-75028arraytics · CVSS 7.5 · 0.7% likely

    CWE-98

12. WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via ShortcodeCVE-2024-5431arraytics · CVSS 8.8 · 0.6% likely

    CWE-98

13. WordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerabilityCVE-2024-56213Arraytics · CVSS 6.5 · 0.6% likely

    CWE-35

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.