File and Path Handling

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload BypassCVE-2025-13065brainstormforce · CVSS 8.8 · 14% likely

   CWE-434

2. SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission DeletionCVE-2025-6691brainstormforce · CVSS 8.1 · 1.0% likely

   CWE-73

3. SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File UploadCVE-2025-13516brainstormforce · CVSS 8.1 · 1.0% likely

   CWE-434

4. Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path TraversalCVE-2024-3107brainstormforce · CVSS 4.3 · 0.6% likely

   CWE-22

5. WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 - Local File Inclusion vulnerabilityCVE-2023-46205Brainstorm Force · CVSS 7.1 · 0.6% likely

   CWE-22

6. WordPress Ultimate Addons for Beaver Builder Premium plugin <= 1.35.13 - Limited Arbitrary File Download vulnerabilityCVE-2023-51401Brainstorm Force · CVSS 6.3 · 0.6% likely

   CWE-22

7. WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerabilityCVE-2026-57401Brainstorm Force · CVSS 9.9 · 0.5% likely

   CWE-22

8. WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerabilityCVE-2026-96837Brainstorm Force · CVSS 8.8 · 0.5% likely

   CWE-98

9. WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerabilityCVE-2026-115604Brainstorm Force · CVSS 5 · 0.4% likely

   CWE-22

10. Custom Fonts – Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site ScriptingCVE-2024-1332brainstormforce · CVSS 6.4 · 0.3% likely

    CWE-434

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.