# Vulnerabilities published in 2026


- [CVE-2026-66673](https://insights.sbomify.com/CVE-2026-66673/): WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66672](https://insights.sbomify.com/CVE-2026-66672/): WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-66671](https://insights.sbomify.com/CVE-2026-66671/): WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-66670](https://insights.sbomify.com/CVE-2026-66670/): WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-6667](https://insights.sbomify.com/CVE-2026-6667/): PgBouncer missing authorization check in KILL_CLIENT admin command (medium 4.3)
- [CVE-2026-66668](https://insights.sbomify.com/CVE-2026-66668/): WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-66667](https://insights.sbomify.com/CVE-2026-66667/): WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66666](https://insights.sbomify.com/CVE-2026-66666/): Information disclosure in WordPress (medium 6.9)
- [CVE-2026-66665](https://insights.sbomify.com/CVE-2026-66665/): WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2026-66664](https://insights.sbomify.com/CVE-2026-66664/): WordPress SEO plugin by Squirrly SEO plugin <= 14.2.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66663](https://insights.sbomify.com/CVE-2026-66663/): WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66662](https://insights.sbomify.com/CVE-2026-66662/): WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-66661](https://insights.sbomify.com/CVE-2026-66661/): WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability (high 7.7)
- [CVE-2026-66660](https://insights.sbomify.com/CVE-2026-66660/): WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-6666](https://insights.sbomify.com/CVE-2026-6666/): PgBouncer crash in kill_pool_logins_server_error (medium 5.9)
- [CVE-2026-66659](https://insights.sbomify.com/CVE-2026-66659/): WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-66658](https://insights.sbomify.com/CVE-2026-66658/): WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-66657](https://insights.sbomify.com/CVE-2026-66657/): WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-66656](https://insights.sbomify.com/CVE-2026-66656/): WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-66655](https://insights.sbomify.com/CVE-2026-66655/): WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66654](https://insights.sbomify.com/CVE-2026-66654/): WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability (medium 6.0)
- [CVE-2026-66653](https://insights.sbomify.com/CVE-2026-66653/): WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-66652](https://insights.sbomify.com/CVE-2026-66652/): WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-66651](https://insights.sbomify.com/CVE-2026-66651/): WordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-66650](https://insights.sbomify.com/CVE-2026-66650/): WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-6665](https://insights.sbomify.com/CVE-2026-6665/): PgBouncer buffer overflow in SCRAM (high 8.1)
- [CVE-2026-66649](https://insights.sbomify.com/CVE-2026-66649/): WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-66648](https://insights.sbomify.com/CVE-2026-66648/): WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-66647](https://insights.sbomify.com/CVE-2026-66647/): WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-66646](https://insights.sbomify.com/CVE-2026-66646/): WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66645](https://insights.sbomify.com/CVE-2026-66645/): WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66644](https://insights.sbomify.com/CVE-2026-66644/): WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66643](https://insights.sbomify.com/CVE-2026-66643/): WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66642](https://insights.sbomify.com/CVE-2026-66642/): WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-66641](https://insights.sbomify.com/CVE-2026-66641/): WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66640](https://insights.sbomify.com/CVE-2026-66640/): WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-6664](https://insights.sbomify.com/CVE-2026-6664/): PgBouncer integer overflow in PgBouncer network packet parsing (high 7.5)
- [CVE-2026-66639](https://insights.sbomify.com/CVE-2026-66639/): WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66638](https://insights.sbomify.com/CVE-2026-66638/): WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66637](https://insights.sbomify.com/CVE-2026-66637/): WordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66636](https://insights.sbomify.com/CVE-2026-66636/): WordPress Wise Chat plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66635](https://insights.sbomify.com/CVE-2026-66635/): WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability (high 7.4)
- [CVE-2026-66634](https://insights.sbomify.com/CVE-2026-66634/): WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-66633](https://insights.sbomify.com/CVE-2026-66633/): WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66632](https://insights.sbomify.com/CVE-2026-66632/): WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability (medium 6.5)
- [CVE-2026-66631](https://insights.sbomify.com/CVE-2026-66631/): WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-66630](https://insights.sbomify.com/CVE-2026-66630/): WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-6663](https://insights.sbomify.com/CVE-2026-6663/): GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent (medium 4.8)
- [CVE-2026-66629](https://insights.sbomify.com/CVE-2026-66629/): WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66628](https://insights.sbomify.com/CVE-2026-66628/): WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-66627](https://insights.sbomify.com/CVE-2026-66627/): WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-66626](https://insights.sbomify.com/CVE-2026-66626/): WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-66625](https://insights.sbomify.com/CVE-2026-66625/): WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-66624](https://insights.sbomify.com/CVE-2026-66624/): WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-66623](https://insights.sbomify.com/CVE-2026-66623/): WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66622](https://insights.sbomify.com/CVE-2026-66622/): WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability (high 7.5)
- [CVE-2026-66621](https://insights.sbomify.com/CVE-2026-66621/): WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66620](https://insights.sbomify.com/CVE-2026-66620/): WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-6662](https://insights.sbomify.com/CVE-2026-6662/): ericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy (medium 6.9)
- [CVE-2026-66619](https://insights.sbomify.com/CVE-2026-66619/): WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-66618](https://insights.sbomify.com/CVE-2026-66618/): WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-66617](https://insights.sbomify.com/CVE-2026-66617/): WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66616](https://insights.sbomify.com/CVE-2026-66616/): WordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66615](https://insights.sbomify.com/CVE-2026-66615/): WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66614](https://insights.sbomify.com/CVE-2026-66614/): WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66613](https://insights.sbomify.com/CVE-2026-66613/): WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability (critical 9.8)
- [CVE-2026-66612](https://insights.sbomify.com/CVE-2026-66612/): WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66611](https://insights.sbomify.com/CVE-2026-66611/): WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66610](https://insights.sbomify.com/CVE-2026-66610/): WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66609](https://insights.sbomify.com/CVE-2026-66609/): WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-66608](https://insights.sbomify.com/CVE-2026-66608/): Server-side request forgery in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (medium 6.4)
- [CVE-2026-66607](https://insights.sbomify.com/CVE-2026-66607/): WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66606](https://insights.sbomify.com/CVE-2026-66606/): WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66605](https://insights.sbomify.com/CVE-2026-66605/): Cross-site scripting in Swatchly – WooCommerce Variation Swatches for Products (high 7.1)
- [CVE-2026-66604](https://insights.sbomify.com/CVE-2026-66604/): WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66603](https://insights.sbomify.com/CVE-2026-66603/): WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66602](https://insights.sbomify.com/CVE-2026-66602/): WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-66601](https://insights.sbomify.com/CVE-2026-66601/): WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66600](https://insights.sbomify.com/CVE-2026-66600/): WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2026-66599](https://insights.sbomify.com/CVE-2026-66599/): WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66598](https://insights.sbomify.com/CVE-2026-66598/): WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66597](https://insights.sbomify.com/CVE-2026-66597/): WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66596](https://insights.sbomify.com/CVE-2026-66596/): WordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66595](https://insights.sbomify.com/CVE-2026-66595/): WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability (medium 5.9)
- [CVE-2026-66594](https://insights.sbomify.com/CVE-2026-66594/): WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-66593](https://insights.sbomify.com/CVE-2026-66593/): WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-66592](https://insights.sbomify.com/CVE-2026-66592/): WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-66591](https://insights.sbomify.com/CVE-2026-66591/): WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66590](https://insights.sbomify.com/CVE-2026-66590/): WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-6659](https://insights.sbomify.com/CVE-2026-6659/): Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts (high 7.5)
- [CVE-2026-66589](https://insights.sbomify.com/CVE-2026-66589/): WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-66587](https://insights.sbomify.com/CVE-2026-66587/): WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability (critical 9.8)
- [CVE-2026-66586](https://insights.sbomify.com/CVE-2026-66586/): WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability (medium 6.6)
- [CVE-2026-66585](https://insights.sbomify.com/CVE-2026-66585/): WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-66584](https://insights.sbomify.com/CVE-2026-66584/): WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66583](https://insights.sbomify.com/CVE-2026-66583/): WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-66582](https://insights.sbomify.com/CVE-2026-66582/): WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66581](https://insights.sbomify.com/CVE-2026-66581/): WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66580](https://insights.sbomify.com/CVE-2026-66580/): WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-6658](https://insights.sbomify.com/CVE-2026-6658/): Cross-site Scripting (XSS) in jupyter/nbconvert (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/454/