Cross-Site Request Forgery

Every one of the 11 is a mark on the map. Named now: 1 to 11, most at risk first.

1. The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactform…CVE-2015-9233Codepeople · 1.0% likely

   CWE-352

2. Corner Ad <= 1.0.56 - Cross-Site Request ForgeryCVE-2022-3427codepeople · CVSS 8.8 · 0.7% likely

   CWE-352

3. The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.CVE-2018-20964Codepeople · 0.7% likely

   CWE-352

4. Booking Calendar < 1.3.83 - CSRF appointment schedulingCVE-2024-0856Codepeople · CVSS 8.8 · 0.4% likely

   CWE-352

5. Smart Image Gallery < 1.0.19 - Update/Delete Google API Key via CSRFCVE-2024-3632Codepeople · CVSS 6.8 · 0.3% likely

   CWE-352

6. CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request ForgeryCVE-2024-13758codepeople · CVSS 6.5 · 0.3% likely

   CWE-352

7. WordPress CP Blocks Plugin <= 1.0.20 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-41732CodePeople · CVSS 5.4 · 0.2% likely

   CWE-352

8. WordPress CP Media Player plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-31941CodePeople · CVSS 5.4 · 0.2% likely

   CWE-352

9. WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerabilityCVE-2025-46241codepeople · CVSS 8.2 · 0.2% likely

   CWE-352

10. WordPress Calculated Fields Form plugin <= 5.3.58 - Cross Site Request Forgery (CSRF) VulnerabilityCVE-2025-49291codepeople · CVSS 4.3 · 0.2% likely

    CWE-352

11. WordPress WP Time Slots Booking Form plugin <= 1.2.30 - Cross Site Request Forgery (CSRF) VulnerabilityCVE-2025-49332codepeople · CVSS 4.3 · 0.2% likely

    CWE-352

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.