Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 455 of 1013.
- CVE-2026-66579 WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66578 WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66577 WordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66576 WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66575 WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-66574 WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66573 WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66572 WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66571 WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-6657 CORS Origin Validation Bypass in jupyter-server
- CVE-2026-66569 WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability
- CVE-2026-66568 WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability
- CVE-2026-66567 WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability
- CVE-2026-66566 WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability
- CVE-2026-66565 WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability
- CVE-2026-66564 WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability
- CVE-2026-66563 WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability
- CVE-2026-6656 Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks
- CVE-2026-6654 Use-After-Free and Double-Free in IntoIter::drop when element drop panics
- CVE-2026-6653 libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling
- CVE-2026-6652 Pagekit CMS StringStorage Template PhpEngine.php evaluate eval injection
- CVE-2026-6651 erponline.xyz ERP Online Inventory Edit Item cross site scripting
- CVE-2026-6650 Z-BlogPHP ZBA File app_upload.php UnPack unrestricted upload
- CVE-2026-66494 Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0
- CVE-2026-66493 Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3
- CVE-2026-66492 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3
- CVE-2026-66491 Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3
- CVE-2026-66490 Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
- CVE-2026-6649 Qibo CMS headers server-side request forgery
- CVE-2026-66489 Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2
- CVE-2026-66488 Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
- CVE-2026-66486 Improper Output Encoding in GNU cpio
- CVE-2026-66485 Uncontrolled Memory Allocation in GNU cpio
- CVE-2026-66484 Path Traversal in GNU cpio
- CVE-2026-66483 WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability
- CVE-2026-66482 WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability
- CVE-2026-66481 WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability
- CVE-2026-66480 WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability
- CVE-2026-6648 Qibo CMS Internal Message cross site scripting
- CVE-2026-66479 WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability
- CVE-2026-66478 WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability
- CVE-2026-66477 WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability
- CVE-2026-66476 WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability
- CVE-2026-66475 Cross-site scripting in Checkout Field Editor for WooCommerce – Checkout Manager
- CVE-2026-66474 WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-66473 WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability
- CVE-2026-66472 WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability
- CVE-2026-66471 WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66470 WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability
- CVE-2026-6647 Auth bypass in WSO2 Carbon OAuth
- CVE-2026-66469 WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability
- CVE-2026-66468 WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66467 WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66466 Missing authorization in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart
- CVE-2026-66465 WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability
- CVE-2026-66464 WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability
- CVE-2026-66463 WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability
- CVE-2026-66462 WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability
- CVE-2026-66461 WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability
- CVE-2026-66460 WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6646 The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter
- CVE-2026-66459 WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability
- CVE-2026-66458 WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability
- CVE-2026-66457 WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66456 WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66455 WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability
- CVE-2026-66454 WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability
- CVE-2026-66453 WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability
- CVE-2026-66452 WordPress Legal Text Connector of the IT-Recht Kanzlei plugin <= 1.0.13 - Broken Access Control vulnerability
- CVE-2026-66451 WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability
- CVE-2026-66450 WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability
- CVE-2026-6645 Insecure Search Path Vulnerability in PaperCut Print Deploy Client for Windows
- CVE-2026-66449 WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66448 WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66447 WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability
- CVE-2026-66446 WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability
- CVE-2026-66445 WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66444 WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability
- CVE-2026-66443 WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability
- CVE-2026-66442 WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability
- CVE-2026-66441 WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability
- CVE-2026-66440 WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6644 A command injection vulnerability was found in the PPTP VPN Clients on the ADM
- CVE-2026-66439 WordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66438 WordPress Exclusive Addons Elementor plugin <= 2.8.0 - Sensitive Data Exposure vulnerability
- CVE-2026-66437 WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-66436 WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability
- CVE-2026-66435 WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerability
- CVE-2026-66434 Cross-site scripting in Photonic Gallery & Lightbox for Flickr, SmugMug & Others
- CVE-2026-66433 WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66432 WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability
- CVE-2026-66431 Missing authorization in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK)
- CVE-2026-66430 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability
- CVE-2026-6643 A stack-based buffer overflow vulnerability in the VPN Clients on the ADM
- CVE-2026-66429 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66428 WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-66427 WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability
- CVE-2026-66426 WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66425 Auth bypass in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
- CVE-2026-66424 WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability