Access Control

Every one of the 18 is a mark on the map. Named now: 1 to 18, most at risk first.

1. Essential Blocks <= 4.0.6 - Missing Authorization via templatesCVE-2023-2085wpdevteam · CVSS 4.3 · 0.6% likely

   CWE-862

2. Essential Blocks <= 4.0.6 - Missing Authorization via template_countCVE-2023-2086wpdevteam · CVSS 4.3 · 0.6% likely

   CWE-862

3. Essential Blocks <= 4.0.6 - Missing Authorization via saveCVE-2023-2083wpdevteam · CVSS 4.3 · 0.6% likely

   CWE-862

4. EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_dataCVE-2023-4282wpdevteam · CVSS 5.4 · 0.5% likely

   CWE-862

5. Essential Blocks <= 4.0.6 - Missing Authorization via getCVE-2023-2084wpdevteam · CVSS 4.3 · 0.5% likely

   CWE-862

6. Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor RevisionCVE-2026-118205wpdevteam · CVSS 7.4 · 0.5% likely

   CWE-269

7. Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege EscalationCVE-2021-4447wpdevteam · CVSS 8.8 · 0.5% likely

   CWE-862

8. BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX ActionCVE-2026-19801wpdevteam · CVSS 4.3 · 0.4% likely

   CWE-862

9. Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information ExposureCVE-2026-1004wpdevteam · CVSS 5.3 · 0.4% likely

   CWE-862

10. BetterDocs <= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information DisclosureCVE-2025-7499wpdevteam · CVSS 5.3 · 0.3% likely

    CWE-862

11. Essential Blocks <= 5.7.2 - Missing Authorization To Authenticated (Author+) Information DisclosureCVE-2025-11369wpdevteam · CVSS 4.3 · 0.3% likely

    CWE-862

12. NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics ResetCVE-2026-0554wpdevteam · CVSS 4.3 · 0.3% likely

    CWE-862

13. EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks…CVE-2024-1803wpdevteam · CVSS 4.3 · 0.3% likely

    CWE-285

14. Templately <= 3.4.8 - Unauthenticated Limited Arbitrary JSON File WriteCVE-2026-0831wpdevteam · CVSS 5.3 · 0.3% likely

    CWE-863

15. BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API UsageCVE-2026-6393wpdevteam · CVSS 4.3 · 0.3% likely

    CWE-862

16. Essential Addons for Elementor <= 4.6.4 - Missing AuthorizationCVE-2021-4446wpdevteam · CVSS 6.3 · 0.3% likely

    CWE-862

17. NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST RouteCVE-2026-110721wpdevteam · CVSS 5.3 · 0.2% likely

    CWE-862

18. Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_userCVE-2026-5193wpdevteam · CVSS 6.5 · 0.2% likely

    CWE-269

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.