# Vulnerabilities published in 2026


- [CVE-2026-97339](https://insights.sbomify.com/CVE-2026-97339/): Cross-site scripting in Complianz GDPR/CCPA Cookie Consent Banner (high 7.2)
- [CVE-2026-97338](https://insights.sbomify.com/CVE-2026-97338/): Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name (medium 6.4)
- [CVE-2026-97337](https://insights.sbomify.com/CVE-2026-97337/): Missing authorization in Simple Membership (high 7.5)
- [CVE-2026-97336](https://insights.sbomify.com/CVE-2026-97336/): CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type (high 7.2)
- [CVE-2026-97335](https://insights.sbomify.com/CVE-2026-97335/): Incorrect authorization in LXD storage volume API allows reading volumes from other projects (high 7.7)
- [CVE-2026-97334](https://insights.sbomify.com/CVE-2026-97334/): Network messaging layer decompression resource exhaustion (high 8.7)
- [CVE-2026-97333](https://insights.sbomify.com/CVE-2026-97333/): QAPI stack-based buffer overflow (high 7.1)
- [CVE-2026-97332](https://insights.sbomify.com/CVE-2026-97332/): User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite) (medium 5.3)
- [CVE-2026-97331](https://insights.sbomify.com/CVE-2026-97331/): User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access (medium 4.3)
- [CVE-2026-9733](https://insights.sbomify.com/CVE-2026-9733/): Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter (critical 9.1)
- [CVE-2026-97328](https://insights.sbomify.com/CVE-2026-97328/): WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser (high 7.5)
- [CVE-2026-97326](https://insights.sbomify.com/CVE-2026-97326/): songxinjianqwe Chat chat-server ChatServer.java server-side request forgery (medium 6.9)
- [CVE-2026-97325](https://insights.sbomify.com/CVE-2026-97325/): YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect (medium 5.3)
- [CVE-2026-97324](https://insights.sbomify.com/CVE-2026-97324/): Missing authorization in ruoyi-vue-pro (medium 6.9)
- [CVE-2026-97323](https://insights.sbomify.com/CVE-2026-97323/): YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal (medium 5.3)
- [CVE-2026-97322](https://insights.sbomify.com/CVE-2026-97322/): YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting (medium 5.3)
- [CVE-2026-97321](https://insights.sbomify.com/CVE-2026-97321/): SQL injection in ruoyi-vue-pro (medium 5.3)
- [CVE-2026-97320](https://insights.sbomify.com/CVE-2026-97320/): Server-side request forgery in ruoyi-vue-pro (medium 5.3)
- [CVE-2026-9732](https://insights.sbomify.com/CVE-2026-9732/): EmergencyWP <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update (medium 4.3)
- [CVE-2026-97319](https://insights.sbomify.com/CVE-2026-97319/): PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block (medium 6.8)
- [CVE-2026-97318](https://insights.sbomify.com/CVE-2026-97318/): Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter (medium 6.1)
- [CVE-2026-97317](https://insights.sbomify.com/CVE-2026-97317/): Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page (medium 5.3)
- [CVE-2026-97316](https://insights.sbomify.com/CVE-2026-97316/): Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect Bypass (medium 5.8)
- [CVE-2026-97315](https://insights.sbomify.com/CVE-2026-97315/): Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email (medium 5.4)
- [CVE-2026-97314](https://insights.sbomify.com/CVE-2026-97314/): Information disclosure in ThirstyAffiliates (medium 6.5)
- [CVE-2026-97313](https://insights.sbomify.com/CVE-2026-97313/): Specific RPZ configurations and query patterns may result in an unexpected exit (high 7.5)
- [CVE-2026-97312](https://insights.sbomify.com/CVE-2026-97312/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-97311](https://insights.sbomify.com/CVE-2026-97311/): Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization (medium 4.3)
- [CVE-2026-9731](https://insights.sbomify.com/CVE-2026-9731/): Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update (medium 4.3)
- [CVE-2026-97309](https://insights.sbomify.com/CVE-2026-97309/): WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability (high 7.1)
- [CVE-2026-97308](https://insights.sbomify.com/CVE-2026-97308/): WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability (medium 4.8)
- [CVE-2026-97307](https://insights.sbomify.com/CVE-2026-97307/): WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-97305](https://insights.sbomify.com/CVE-2026-97305/): WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability (medium 6.9)
- [CVE-2026-97304](https://insights.sbomify.com/CVE-2026-97304/): WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-97303](https://insights.sbomify.com/CVE-2026-97303/): WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability (high 7.6)
- [CVE-2026-97302](https://insights.sbomify.com/CVE-2026-97302/): WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-97301](https://insights.sbomify.com/CVE-2026-97301/): WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97300](https://insights.sbomify.com/CVE-2026-97300/): WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-9730](https://insights.sbomify.com/CVE-2026-9730/): Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-97299](https://insights.sbomify.com/CVE-2026-97299/): WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-97298](https://insights.sbomify.com/CVE-2026-97298/): WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97297](https://insights.sbomify.com/CVE-2026-97297/): WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability (high 7.6)
- [CVE-2026-97296](https://insights.sbomify.com/CVE-2026-97296/): WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-97295](https://insights.sbomify.com/CVE-2026-97295/): WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-97294](https://insights.sbomify.com/CVE-2026-97294/): WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97293](https://insights.sbomify.com/CVE-2026-97293/): WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-97292](https://insights.sbomify.com/CVE-2026-97292/): WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97291](https://insights.sbomify.com/CVE-2026-97291/): WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-97290](https://insights.sbomify.com/CVE-2026-97290/): Cross-site scripting in Photonic Gallery & Lightbox for Flickr, SmugMug & Others (high 7.1)
- [CVE-2026-9729](https://insights.sbomify.com/CVE-2026-9729/): Cross-site scripting in Web Push Notifications – Webpushr (medium 6.4)
- [CVE-2026-97289](https://insights.sbomify.com/CVE-2026-97289/): WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97288](https://insights.sbomify.com/CVE-2026-97288/): WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97287](https://insights.sbomify.com/CVE-2026-97287/): WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-97286](https://insights.sbomify.com/CVE-2026-97286/): WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97285](https://insights.sbomify.com/CVE-2026-97285/): WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-97284](https://insights.sbomify.com/CVE-2026-97284/): WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-97283](https://insights.sbomify.com/CVE-2026-97283/): WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-97282](https://insights.sbomify.com/CVE-2026-97282/): WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-97281](https://insights.sbomify.com/CVE-2026-97281/): WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-97280](https://insights.sbomify.com/CVE-2026-97280/): WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-9728](https://insights.sbomify.com/CVE-2026-9728/): TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory (medium 6.4)
- [CVE-2026-97279](https://insights.sbomify.com/CVE-2026-97279/): WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97278](https://insights.sbomify.com/CVE-2026-97278/): WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-97277](https://insights.sbomify.com/CVE-2026-97277/): WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability (high 7.6)
- [CVE-2026-97276](https://insights.sbomify.com/CVE-2026-97276/): WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97275](https://insights.sbomify.com/CVE-2026-97275/): Business logic in BuildKit – Product Builder for WooCommerce – Custom PC Builder (medium 5.3)
- [CVE-2026-97274](https://insights.sbomify.com/CVE-2026-97274/): WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability (critical 9.8)
- [CVE-2026-97273](https://insights.sbomify.com/CVE-2026-97273/): WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97272](https://insights.sbomify.com/CVE-2026-97272/): WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97271](https://insights.sbomify.com/CVE-2026-97271/): WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97270](https://insights.sbomify.com/CVE-2026-97270/): WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97269](https://insights.sbomify.com/CVE-2026-97269/): WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-97268](https://insights.sbomify.com/CVE-2026-97268/): WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97267](https://insights.sbomify.com/CVE-2026-97267/): WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-97266](https://insights.sbomify.com/CVE-2026-97266/): WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97265](https://insights.sbomify.com/CVE-2026-97265/): WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97264](https://insights.sbomify.com/CVE-2026-97264/): WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97263](https://insights.sbomify.com/CVE-2026-97263/): WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97262](https://insights.sbomify.com/CVE-2026-97262/): WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97261](https://insights.sbomify.com/CVE-2026-97261/): WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-97260](https://insights.sbomify.com/CVE-2026-97260/): WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-9726](https://insights.sbomify.com/CVE-2026-9726/): Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038 (critical 9.8)
- [CVE-2026-97259](https://insights.sbomify.com/CVE-2026-97259/): WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-97258](https://insights.sbomify.com/CVE-2026-97258/): WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-97257](https://insights.sbomify.com/CVE-2026-97257/): WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-97256](https://insights.sbomify.com/CVE-2026-97256/): WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-97255](https://insights.sbomify.com/CVE-2026-97255/): WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-97254](https://insights.sbomify.com/CVE-2026-97254/): WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97253](https://insights.sbomify.com/CVE-2026-97253/): WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97251](https://insights.sbomify.com/CVE-2026-97251/): Missing authorization in Bus Ticket Booking with Seat Reservation (medium 6.5)
- [CVE-2026-97250](https://insights.sbomify.com/CVE-2026-97250/): WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-9725](https://insights.sbomify.com/CVE-2026-9725/): Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion (critical 9.1)
- [CVE-2026-97249](https://insights.sbomify.com/CVE-2026-97249/): WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2026-97248](https://insights.sbomify.com/CVE-2026-97248/): WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-97247](https://insights.sbomify.com/CVE-2026-97247/): WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-97246](https://insights.sbomify.com/CVE-2026-97246/): WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability (medium 4.9)
- [CVE-2026-97245](https://insights.sbomify.com/CVE-2026-97245/): WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-97244](https://insights.sbomify.com/CVE-2026-97244/): WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability (high 7.5)
- [CVE-2026-97243](https://insights.sbomify.com/CVE-2026-97243/): WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-97242](https://insights.sbomify.com/CVE-2026-97242/): WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/219/