Server-Side Request Forgery

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request ForgeryCVE-2025-8680bplugins · CVSS 4.3 · 0.4% likely

   CWE-918

2. All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy EndpointCVE-2026-1294bplugins · CVSS 7.2 · 0.3% likely

   CWE-918

3. Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request ForgeryCVE-2025-10735bplugins · CVSS 4 · 0.3% likely

   CWE-918

4. HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request ForgeryCVE-2025-13999bplugins · CVSS 7.2 · 0.2% likely

   CWE-918

5. B Carousel Block – Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request ForgeryCVE-2025-12388bplugins · CVSS 6.4 · 0.2% likely

   CWE-918

6. Icon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request ForgeryCVE-2025-12376bplugins · CVSS 6.4 · 0.2% likely

   CWE-918

7. WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerabilityCVE-2026-62030bPlugins · CVSS 7.2 · 0.2% likely

   CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.