Access Control

Every one of the 21 is a mark on the map. Named now: 1 to 21, most at risk first.

1. AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actionsCVE-2023-5533quantumcloud · CVSS 5.3 · 0.6% likely

   CWE-862

2. WordPress Simple Business Directory Pro plugin < 15.6.9 - Privilege Escalation vulnerabilityCVE-2025-31918quantumcloud · CVSS 9.8 · 0.5% likely

   CWE-266

3. WordPress Floating Action Buttons plugin <= 0.9.1 - Broken Access Control vulnerabilityCVE-2024-56238QuantumCloud · CVSS 5.3 · 0.5% likely

   CWE-862

4. WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' ParameterCVE-2026-15106quantumcloud · CVSS 5.3 · 0.5% likely

   CWE-862

5. WordPress Floating Buttons for WooCommerce plugin <= 2.8.8 - Broken Access Control vulnerabilityCVE-2024-52395QuantumCloud · CVSS 5.3 · 0.4% likely

   CWE-862

6. WordPress Simple Business Directory Pro Plugin < 15.6.9 - Privilege Escalation VulnerabilityCVE-2025-53580quantumcloud · CVSS 9.8 · 0.4% likely

   CWE-266

7. WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX ActionCVE-2026-16774quantumcloud · CVSS 5.3 · 0.4% likely

   CWE-862

8. WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() FunctionCVE-2026-15610quantumcloud · CVSS 4.3 · 0.4% likely

   CWE-862

9. AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callbackCVE-2024-0451quantumcloud · CVSS 5 · 0.4% likely

   CWE-284

10. AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callbackCVE-2024-0453quantumcloud · CVSS 5 · 0.4% likely

    CWE-284

11. AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callbackCVE-2024-0452quantumcloud · CVSS 5 · 0.4% likely

    CWE-284

12. WordPress Simple Link Directory Pro plugin < 14.8.1 - Broken Access Control VulnerabilityCVE-2025-32296quantumcloud · CVSS 5.3 · 0.3% likely

    CWE-862

13. Infographic Maker iList <= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title UpdateCVE-2024-5858quantumcloud · CVSS 4.3 · 0.3% likely

    CWE-862

14. WordPress SEO Help plugin <= 6.7.9 - Broken Access Control vulnerabilityCVE-2025-32244QuantumCloud · CVSS 6.5 · 0.3% likely

    CWE-862

15. WordPress ChatBot plugin <= 7.9.7 - Broken Access Control vulnerabilityCVE-2026-40788QuantumCloud · CVSS 7.1 · 0.3% likely

    CWE-862

16. WordPress Simple Link Directory plugin <= 8.8.3 - Broken Access Control vulnerabilityCVE-2025-67576QuantumCloud · CVSS 5.3 · 0.3% likely

    CWE-862

17. WordPress ChatBot plugin <= 7.3.9 - Broken Access Control vulnerabilityCVE-2025-64277QuantumCloud · CVSS 5.3 · 0.3% likely

    CWE-862

18. WPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response CreationCVE-2024-12879QuantumCloud · CVSS 4.3 · 0.3% likely

    CWE-862

19. AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX ActionCVE-2026-111372quantumcloud · CVSS 4.3 · 0.3% likely

    CWE-862

20. WordPress ChatBot plugin <= 6.7.3 - Broken Access Control VulnerabilityCVE-2025-53200QuantumCloud · CVSS 4.3 · 0.3% likely

    CWE-862

21. WordPress ChatBot plugin <= 7.7.3 - Broken Access Control vulnerabilityCVE-2025-62952QuantumCloud · CVSS 4.3 · 0.2% likely

    CWE-862

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.