Userpro

Every one of the 2 is a mark on the map. Named now: 1 to 2, most at risk first.

1. The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access…CVE-2017-16562Userproplugin · 27% likely

   CWE-287

2. The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.CVE-2018-16285Userproplugin · 1.3% likely

   CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.