# Vulnerabilities published in 2026


- [CVE-2026-66579](https://insights.sbomify.com/CVE-2026-66579/): WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66578](https://insights.sbomify.com/CVE-2026-66578/): WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66577](https://insights.sbomify.com/CVE-2026-66577/): WordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66576](https://insights.sbomify.com/CVE-2026-66576/): WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66575](https://insights.sbomify.com/CVE-2026-66575/): WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-66574](https://insights.sbomify.com/CVE-2026-66574/): WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66573](https://insights.sbomify.com/CVE-2026-66573/): WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66572](https://insights.sbomify.com/CVE-2026-66572/): WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66571](https://insights.sbomify.com/CVE-2026-66571/): WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2026-6657](https://insights.sbomify.com/CVE-2026-6657/): CORS Origin Validation Bypass in jupyter-server (medium 6.1)
- [CVE-2026-66569](https://insights.sbomify.com/CVE-2026-66569/): WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-66568](https://insights.sbomify.com/CVE-2026-66568/): WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-66567](https://insights.sbomify.com/CVE-2026-66567/): WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-66566](https://insights.sbomify.com/CVE-2026-66566/): WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-66565](https://insights.sbomify.com/CVE-2026-66565/): WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-66564](https://insights.sbomify.com/CVE-2026-66564/): WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-66563](https://insights.sbomify.com/CVE-2026-66563/): WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-6656](https://insights.sbomify.com/CVE-2026-6656/): Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks (high 7.5)
- [CVE-2026-6654](https://insights.sbomify.com/CVE-2026-6654/): Use-After-Free and Double-Free in IntoIter::drop when element drop panics (medium 5.1)
- [CVE-2026-6653](https://insights.sbomify.com/CVE-2026-6653/): libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling (high 7.0)
- [CVE-2026-6652](https://insights.sbomify.com/CVE-2026-6652/): Pagekit CMS StringStorage Template PhpEngine.php evaluate eval injection (medium 5.1)
- [CVE-2026-6651](https://insights.sbomify.com/CVE-2026-6651/): erponline.xyz ERP Online Inventory Edit Item cross site scripting (medium 4.8)
- [CVE-2026-6650](https://insights.sbomify.com/CVE-2026-6650/): Z-BlogPHP ZBA File app_upload.php UnPack unrestricted upload (medium 5.1)
- [CVE-2026-66494](https://insights.sbomify.com/CVE-2026-66494/): Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 (high 8.7)
- [CVE-2026-66493](https://insights.sbomify.com/CVE-2026-66493/): Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3 (medium 6.4)
- [CVE-2026-66492](https://insights.sbomify.com/CVE-2026-66492/): Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 (medium 6.1)
- [CVE-2026-66491](https://insights.sbomify.com/CVE-2026-66491/): Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 (high 8.2)
- [CVE-2026-66490](https://insights.sbomify.com/CVE-2026-66490/): Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 (medium 6.1)
- [CVE-2026-6649](https://insights.sbomify.com/CVE-2026-6649/): Qibo CMS headers server-side request forgery (medium 5.3)
- [CVE-2026-66489](https://insights.sbomify.com/CVE-2026-66489/): Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2 (medium 5.3)
- [CVE-2026-66488](https://insights.sbomify.com/CVE-2026-66488/): Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2 (medium 5.3)
- [CVE-2026-66486](https://insights.sbomify.com/CVE-2026-66486/): Improper Output Encoding in GNU cpio (medium 4.6)
- [CVE-2026-66485](https://insights.sbomify.com/CVE-2026-66485/): Uncontrolled Memory Allocation in GNU cpio (medium 4.6)
- [CVE-2026-66484](https://insights.sbomify.com/CVE-2026-66484/): Path Traversal in GNU cpio (medium 4.6)
- [CVE-2026-66483](https://insights.sbomify.com/CVE-2026-66483/): WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-66482](https://insights.sbomify.com/CVE-2026-66482/): WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-66481](https://insights.sbomify.com/CVE-2026-66481/): WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability (medium 6.8)
- [CVE-2026-66480](https://insights.sbomify.com/CVE-2026-66480/): WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-6648](https://insights.sbomify.com/CVE-2026-6648/): Qibo CMS Internal Message cross site scripting (medium 5.1)
- [CVE-2026-66479](https://insights.sbomify.com/CVE-2026-66479/): WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2026-66478](https://insights.sbomify.com/CVE-2026-66478/): WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-66477](https://insights.sbomify.com/CVE-2026-66477/): WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-66476](https://insights.sbomify.com/CVE-2026-66476/): WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability (medium 4.9)
- [CVE-2026-66475](https://insights.sbomify.com/CVE-2026-66475/): Cross-site scripting in Checkout Field Editor for WooCommerce &#8211; Checkout Manager (medium 5.9)
- [CVE-2026-66474](https://insights.sbomify.com/CVE-2026-66474/): WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-66473](https://insights.sbomify.com/CVE-2026-66473/): WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-66472](https://insights.sbomify.com/CVE-2026-66472/): WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-66471](https://insights.sbomify.com/CVE-2026-66471/): WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66470](https://insights.sbomify.com/CVE-2026-66470/): WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-6647](https://insights.sbomify.com/CVE-2026-6647/): Auth bypass in WSO2 Carbon OAuth (high 7.4)
- [CVE-2026-66469](https://insights.sbomify.com/CVE-2026-66469/): WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-66468](https://insights.sbomify.com/CVE-2026-66468/): WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66467](https://insights.sbomify.com/CVE-2026-66467/): WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66466](https://insights.sbomify.com/CVE-2026-66466/): Missing authorization in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart (high 7.5)
- [CVE-2026-66465](https://insights.sbomify.com/CVE-2026-66465/): WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability (critical 9.8)
- [CVE-2026-66464](https://insights.sbomify.com/CVE-2026-66464/): WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-66463](https://insights.sbomify.com/CVE-2026-66463/): WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-66462](https://insights.sbomify.com/CVE-2026-66462/): WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-66461](https://insights.sbomify.com/CVE-2026-66461/): WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability (high 7.5)
- [CVE-2026-66460](https://insights.sbomify.com/CVE-2026-66460/): WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-6646](https://insights.sbomify.com/CVE-2026-6646/): The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter (medium 6.4)
- [CVE-2026-66459](https://insights.sbomify.com/CVE-2026-66459/): WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-66458](https://insights.sbomify.com/CVE-2026-66458/): WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-66457](https://insights.sbomify.com/CVE-2026-66457/): WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66456](https://insights.sbomify.com/CVE-2026-66456/): WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66455](https://insights.sbomify.com/CVE-2026-66455/): WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability (medium 6.0)
- [CVE-2026-66454](https://insights.sbomify.com/CVE-2026-66454/): WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-66453](https://insights.sbomify.com/CVE-2026-66453/): WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2026-66452](https://insights.sbomify.com/CVE-2026-66452/): WordPress Legal Text Connector of the IT-Recht Kanzlei plugin <= 1.0.13 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-66451](https://insights.sbomify.com/CVE-2026-66451/): WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-66450](https://insights.sbomify.com/CVE-2026-66450/): WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-6645](https://insights.sbomify.com/CVE-2026-6645/): Insecure Search Path Vulnerability in PaperCut Print Deploy Client for Windows (high 7.3)
- [CVE-2026-66449](https://insights.sbomify.com/CVE-2026-66449/): WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66448](https://insights.sbomify.com/CVE-2026-66448/): WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66447](https://insights.sbomify.com/CVE-2026-66447/): WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-66446](https://insights.sbomify.com/CVE-2026-66446/): WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-66445](https://insights.sbomify.com/CVE-2026-66445/): WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66444](https://insights.sbomify.com/CVE-2026-66444/): WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-66443](https://insights.sbomify.com/CVE-2026-66443/): WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-66442](https://insights.sbomify.com/CVE-2026-66442/): WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-66441](https://insights.sbomify.com/CVE-2026-66441/): WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-66440](https://insights.sbomify.com/CVE-2026-66440/): WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-6644](https://insights.sbomify.com/CVE-2026-6644/): A command injection vulnerability was found in the PPTP VPN Clients on the ADM (critical 9.4)
- [CVE-2026-66439](https://insights.sbomify.com/CVE-2026-66439/): WordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66438](https://insights.sbomify.com/CVE-2026-66438/): WordPress Exclusive Addons Elementor plugin <= 2.8.0 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-66437](https://insights.sbomify.com/CVE-2026-66437/): WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2026-66436](https://insights.sbomify.com/CVE-2026-66436/): WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-66435](https://insights.sbomify.com/CVE-2026-66435/): WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerability (medium 5.9)
- [CVE-2026-66434](https://insights.sbomify.com/CVE-2026-66434/): Cross-site scripting in Photonic Gallery & Lightbox for Flickr, SmugMug & Others (medium 6.5)
- [CVE-2026-66433](https://insights.sbomify.com/CVE-2026-66433/): WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-66432](https://insights.sbomify.com/CVE-2026-66432/): WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-66431](https://insights.sbomify.com/CVE-2026-66431/): Missing authorization in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) (high 7.5)
- [CVE-2026-66430](https://insights.sbomify.com/CVE-2026-66430/): WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-6643](https://insights.sbomify.com/CVE-2026-6643/): A stack-based buffer overflow vulnerability in the VPN Clients on the ADM (high 8.6)
- [CVE-2026-66429](https://insights.sbomify.com/CVE-2026-66429/): WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66428](https://insights.sbomify.com/CVE-2026-66428/): WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-66427](https://insights.sbomify.com/CVE-2026-66427/): WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-66426](https://insights.sbomify.com/CVE-2026-66426/): WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-66425](https://insights.sbomify.com/CVE-2026-66425/): Auth bypass in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder (medium 6.5)
- [CVE-2026-66424](https://insights.sbomify.com/CVE-2026-66424/): WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/455/