Access Control

Every one of the 30 is a mark on the map. Named now: 1 to 26, most at risk first.

1. WordPress WP Time Slots Booking Form plugin <= 1.1.82 - Broken Access Control vulnerabilityCVE-2023-23895CodePeople · CVSS 4.7 · 0.7% likely

   CWE-862

2. WordPress Booking Calendar Contact Form plugin <= 1.2.34 - Broken Access Control vulnerabilityCVE-2023-25037CodePeople · CVSS 4.3 · 0.6% likely

   CWE-862

3. WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerabilityCVE-2022-43482CodePeople · CVSS 4.3 · 0.5% likely

   CWE-862

4. WordPress Appointment Hour Booking plugin <= 1.3.71 - Missing Authorization vulnerabilityCVE-2022-41692CodePeople · CVSS 4.3 · 0.5% likely

   CWE-862

5. WordPress Google Maps CP plugin <= 1.0.43 - Missing Authorization Leading To Feedback Submission VulnerabilityCVE-2023-25039CodePeople · CVSS 4.3 · 0.5% likely

   CWE-862

6. Appointment Hour Booking <= 1.3.72 - CAPTCHA BypassCVE-2022-4036codepeople · CVSS 5.3 · 0.5% likely

   CWE-804

7. WordPress Calendar Event Multi View plugin <= 1.4.13 - Broken Access Control vulnerabilityCVE-2023-23814CodePeople · CVSS 3.8 · 0.5% likely

   CWE-862

8. WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access ControlCVE-2022-41790CodePeople · CVSS 4.3 · 0.5% likely

   CWE-862

9. WordPress WP Time Slots Booking Form plugin <= 1.2.06 - Broken Access Control vulnerabilityCVE-2024-33543CodePeople · CVSS 7.5 · 0.4% likely

   CWE-862

10. WordPress WP Time Slots Booking Form plugin <= 1.2.11 - Broken Access Control vulnerabilityCVE-2024-35735CodePeople · CVSS 5.3 · 0.4% likely

    CWE-862

11. WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control VulnerabilityCVE-2025-46247codepeople · CVSS 5.3 · 0.4% likely

    CWE-862

12. Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information DisclosureCVE-2026-12113codepeople · CVSS 4.3 · 0.4% likely

    CWE-862

13. WordPress Appointment Hour Booking plugin <= 1.4.23 - Broken Access Control vulnerabilityCVE-2023-45649codepeople · CVSS 5.3 · 0.4% likely

    CWE-862

14. CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment ConfirmationCVE-2025-13384codepeople · CVSS 7.5 · 0.4% likely

    CWE-862

15. WordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control VulnerabilityCVE-2025-47472codepeople · CVSS 5.4 · 0.3% likely

    CWE-862

16. Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' ParameterCVE-2025-13318codepeople · CVSS 5.3 · 0.3% likely

    CWE-862

17. WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerabilityCVE-2026-32483codepeople · CVSS 6.5 · 0.3% likely

    CWE-862

18. WordPress Contact Form Email plugin <= 1.3.31 - Missing Authorization Leading To Feedback Submission VulnerabilityCVE-2023-28494CodePeople · CVSS 4.3 · 0.3% likely

    CWE-862

19. WordPress Calculated Fields Form plugin <= 1.1.120 - Missing Authorization Leading To Feedback Submission VulnerabilityCVE-2023-26523CodePeople · CVSS 4.3 · 0.3% likely

    CWE-862

20. WordPress Search in Place plugin <= 1.0.104 - Missing Authorization Leading To Feedback Submission vulnerabilityCVE-2023-26521CodePeople · CVSS 4.3 · 0.3% likely

    CWE-862

21. WordPress Calendar Event Multi View plugin <= 1.4.10 - Missing Authorization Leading To Feedback Submission vulnerabilityCVE-2023-28492CodePeople · CVSS 4.3 · 0.3% likely

    CWE-862

22. WordPress CP Multi View Event Calendar plugin <= 1.4.35 - Broken Access Control vulnerabilityCVE-2025-58009codepeople · CVSS 3.8 · 0.3% likely

    CWE-862

23. Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' ParameterCVE-2025-13317codepeople · CVSS 5.3 · 0.3% likely

    CWE-862

24. WordPress WP Time Slots Booking Form plugin <= 1.2.39 - Broken Access Control vulnerabilityCVE-2025-68569codepeople · CVSS 6.5 · 0.3% likely

    CWE-862

25. CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product ImportCVE-2026-0684codepeople · CVSS 4.3 · 0.3% likely

    CWE-863

26. WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerabilityCVE-2026-25368codepeople · CVSS 6.5 · 0.3% likely

    CWE-862

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.