Insecure Direct Object Reference

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. Button Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post DisclosureCVE-2024-10671bplugins · CVSS 4.3 · 0.5% likely

   CWE-639

2. Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post ExposureCVE-2024-10666bplugins · CVSS 4.3 · 0.4% likely

   CWE-639

3. Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post DisclosureCVE-2024-10669bplugins · CVSS 4.3 · 0.3% likely

   CWE-639

4. Content Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post DisclosureCVE-2024-10667bplugins · CVSS 4.3 · 0.3% likely

   CWE-639

5. Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry DeletionCVE-2026-1389bplugins · CVSS 4.3 · 0.2% likely

   CWE-639

6. Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode AttributeCVE-2026-1228bplugins · CVSS 4.3 · 0.2% likely

   CWE-639

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.