Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 462 of 1013.
- CVE-2026-65526 WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability
- CVE-2026-65525 WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability
- CVE-2026-65524 WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability
- CVE-2026-65523 Missing authorization in Formidable Forms Signature Online Contract Automation
- CVE-2026-65522 Cross-site scripting in Manual - Documentation, Knowledge Base & Education WordPress Theme
- CVE-2026-65521 WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability
- CVE-2026-65520 WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability
- CVE-2026-65519 WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65518 WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65517 WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65516 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-65515 WordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65514 WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65513 WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65512 Cross-site request forgery in WP Activity Log
- CVE-2026-65511 Cross-site scripting in Manual - Documentation, Knowledge Base & Education WordPress Theme
- CVE-2026-65510 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6551 Cross-site scripting in Timeline Blocks for Gutenberg
- CVE-2026-65509 WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65508 WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability
- CVE-2026-65507 WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability
- CVE-2026-65506 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability
- CVE-2026-65505 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability
- CVE-2026-65504 WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability
- CVE-2026-65503 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65502 WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability
- CVE-2026-65501 WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-65500 Missing authorization in Manual - Documentation, Knowledge Base & Education WordPress Theme
- CVE-2026-6550 Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python
- CVE-2026-65499 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability
- CVE-2026-65498 WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability
- CVE-2026-65497 WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability
- CVE-2026-65496 WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-65495 WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability
- CVE-2026-65494 WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability
- CVE-2026-65493 WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability
- CVE-2026-65492 WordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65491 WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability
- CVE-2026-65490 WordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerability
- CVE-2026-6549 Cross-site scripting in Logo Manager For Enamad
- CVE-2026-65489 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability
- CVE-2026-65488 Cross-site request forgery in LA-Studio Element Kit for Elementor
- CVE-2026-65487 WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability
- CVE-2026-65486 WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability
- CVE-2026-65485 WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability
- CVE-2026-65484 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability
- CVE-2026-65483 WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65482 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65481 WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability
- CVE-2026-65480 WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65479 WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability
- CVE-2026-65478 WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability
- CVE-2026-65477 WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability
- CVE-2026-65476 WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability
- CVE-2026-65475 WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65474 WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability
- CVE-2026-65473 WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65472 WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability
- CVE-2026-65471 WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-65470 WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65469 WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability
- CVE-2026-65468 WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability
- CVE-2026-65467 WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-65466 WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-65465 WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65464 WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-65463 WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-65462 WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability
- CVE-2026-65461 WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability
- CVE-2026-65460 WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-65459 WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability
- CVE-2026-65458 WordPress Polylang and Polylang Pro plugins <= 3.8.5 - Sensitive Data Exposure vulnerability
- CVE-2026-65457 WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability
- CVE-2026-65456 WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-65455 WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability
- CVE-2026-65454 WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability
- CVE-2026-65453 WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability
- CVE-2026-65452 WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability
- CVE-2026-65451 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
- CVE-2026-65450 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
- CVE-2026-65449 WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65448 WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65447 WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65446 WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65445 WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability
- CVE-2026-65443 WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65442 WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-65441 WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65440 WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6544 Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-65439 WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65438 WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65437 WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-65436 WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability
- CVE-2026-65435 WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability
- CVE-2026-65434 WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerability
- CVE-2026-65433 Missing authorization in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
- CVE-2026-65432 Apache CXF: XXE via WSDL/XSD import parsing
- CVE-2026-65431 Joomla Extension - regularlabs.com - Zipslip in GeoIP extension
- CVE-2026-65430 Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension