# Vulnerabilities published in 2026 - [CVE-2026-65526](https://insights.sbomify.com/CVE-2026-65526/): WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability (high 8.5) - [CVE-2026-65525](https://insights.sbomify.com/CVE-2026-65525/): WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65524](https://insights.sbomify.com/CVE-2026-65524/): WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability (medium 4.3) - [CVE-2026-65523](https://insights.sbomify.com/CVE-2026-65523/): Missing authorization in Formidable Forms Signature Online Contract Automation (high 7.5) - [CVE-2026-65522](https://insights.sbomify.com/CVE-2026-65522/): Cross-site scripting in Manual - Documentation, Knowledge Base & Education WordPress Theme (medium 6.5) - [CVE-2026-65521](https://insights.sbomify.com/CVE-2026-65521/): WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability (medium 5.3) - [CVE-2026-65520](https://insights.sbomify.com/CVE-2026-65520/): WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability (critical 9.3) - [CVE-2026-65519](https://insights.sbomify.com/CVE-2026-65519/): WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65518](https://insights.sbomify.com/CVE-2026-65518/): WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65517](https://insights.sbomify.com/CVE-2026-65517/): WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65516](https://insights.sbomify.com/CVE-2026-65516/): WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability (high 7.2) - [CVE-2026-65515](https://insights.sbomify.com/CVE-2026-65515/): WordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65514](https://insights.sbomify.com/CVE-2026-65514/): WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65513](https://insights.sbomify.com/CVE-2026-65513/): WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65512](https://insights.sbomify.com/CVE-2026-65512/): Cross-site request forgery in WP Activity Log (medium 5.4) - [CVE-2026-65511](https://insights.sbomify.com/CVE-2026-65511/): Cross-site scripting in Manual - Documentation, Knowledge Base & Education WordPress Theme (high 7.1) - [CVE-2026-65510](https://insights.sbomify.com/CVE-2026-65510/): WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-6551](https://insights.sbomify.com/CVE-2026-6551/): Cross-site scripting in Timeline Blocks for Gutenberg (medium 6.4) - [CVE-2026-65509](https://insights.sbomify.com/CVE-2026-65509/): WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65508](https://insights.sbomify.com/CVE-2026-65508/): WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability (critical 9.3) - [CVE-2026-65507](https://insights.sbomify.com/CVE-2026-65507/): WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability (critical 9.8) - [CVE-2026-65506](https://insights.sbomify.com/CVE-2026-65506/): WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65505](https://insights.sbomify.com/CVE-2026-65505/): WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability (medium 5.3) - [CVE-2026-65504](https://insights.sbomify.com/CVE-2026-65504/): WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability (high 7.5) - [CVE-2026-65503](https://insights.sbomify.com/CVE-2026-65503/): WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65502](https://insights.sbomify.com/CVE-2026-65502/): WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability (medium 5.3) - [CVE-2026-65501](https://insights.sbomify.com/CVE-2026-65501/): WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3) - [CVE-2026-65500](https://insights.sbomify.com/CVE-2026-65500/): Missing authorization in Manual - Documentation, Knowledge Base & Education WordPress Theme (high 7.5) - [CVE-2026-6550](https://insights.sbomify.com/CVE-2026-6550/): Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python (medium 5.7) - [CVE-2026-65499](https://insights.sbomify.com/CVE-2026-65499/): WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability (medium 6.5) - [CVE-2026-65498](https://insights.sbomify.com/CVE-2026-65498/): WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability (medium 5.3) - [CVE-2026-65497](https://insights.sbomify.com/CVE-2026-65497/): WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability (high 7.2) - [CVE-2026-65496](https://insights.sbomify.com/CVE-2026-65496/): WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4) - [CVE-2026-65495](https://insights.sbomify.com/CVE-2026-65495/): WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability (high 7.5) - [CVE-2026-65494](https://insights.sbomify.com/CVE-2026-65494/): WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability (high 7.1) - [CVE-2026-65493](https://insights.sbomify.com/CVE-2026-65493/): WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability (high 7.5) - [CVE-2026-65492](https://insights.sbomify.com/CVE-2026-65492/): WordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65491](https://insights.sbomify.com/CVE-2026-65491/): WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability (medium 4.3) - [CVE-2026-65490](https://insights.sbomify.com/CVE-2026-65490/): WordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerability (medium 5.3) - [CVE-2026-6549](https://insights.sbomify.com/CVE-2026-6549/): Cross-site scripting in Logo Manager For Enamad (medium 6.4) - [CVE-2026-65489](https://insights.sbomify.com/CVE-2026-65489/): WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65488](https://insights.sbomify.com/CVE-2026-65488/): Cross-site request forgery in LA-Studio Element Kit for Elementor (high 7.1) - [CVE-2026-65487](https://insights.sbomify.com/CVE-2026-65487/): WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65486](https://insights.sbomify.com/CVE-2026-65486/): WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65485](https://insights.sbomify.com/CVE-2026-65485/): WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65484](https://insights.sbomify.com/CVE-2026-65484/): WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability (medium 6.3) - [CVE-2026-65483](https://insights.sbomify.com/CVE-2026-65483/): WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2026-65482](https://insights.sbomify.com/CVE-2026-65482/): WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65481](https://insights.sbomify.com/CVE-2026-65481/): WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability (high 7.5) - [CVE-2026-65480](https://insights.sbomify.com/CVE-2026-65480/): WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65479](https://insights.sbomify.com/CVE-2026-65479/): WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability (medium 5.4) - [CVE-2026-65478](https://insights.sbomify.com/CVE-2026-65478/): WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability (medium 5.4) - [CVE-2026-65477](https://insights.sbomify.com/CVE-2026-65477/): WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability (high 7.5) - [CVE-2026-65476](https://insights.sbomify.com/CVE-2026-65476/): WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65475](https://insights.sbomify.com/CVE-2026-65475/): WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65474](https://insights.sbomify.com/CVE-2026-65474/): WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability (medium 5.3) - [CVE-2026-65473](https://insights.sbomify.com/CVE-2026-65473/): WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65472](https://insights.sbomify.com/CVE-2026-65472/): WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65471](https://insights.sbomify.com/CVE-2026-65471/): WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability (critical 9.6) - [CVE-2026-65470](https://insights.sbomify.com/CVE-2026-65470/): WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65469](https://insights.sbomify.com/CVE-2026-65469/): WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65468](https://insights.sbomify.com/CVE-2026-65468/): WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65467](https://insights.sbomify.com/CVE-2026-65467/): WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9) - [CVE-2026-65466](https://insights.sbomify.com/CVE-2026-65466/): WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9) - [CVE-2026-65465](https://insights.sbomify.com/CVE-2026-65465/): WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65464](https://insights.sbomify.com/CVE-2026-65464/): WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4) - [CVE-2026-65463](https://insights.sbomify.com/CVE-2026-65463/): WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4) - [CVE-2026-65462](https://insights.sbomify.com/CVE-2026-65462/): WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability (high 7.6) - [CVE-2026-65461](https://insights.sbomify.com/CVE-2026-65461/): WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability (critical 9.1) - [CVE-2026-65460](https://insights.sbomify.com/CVE-2026-65460/): WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2026-65459](https://insights.sbomify.com/CVE-2026-65459/): WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability (high 7.5) - [CVE-2026-65458](https://insights.sbomify.com/CVE-2026-65458/): WordPress Polylang and Polylang Pro plugins <= 3.8.5 - Sensitive Data Exposure vulnerability (medium 4.3) - [CVE-2026-65457](https://insights.sbomify.com/CVE-2026-65457/): WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability (medium 4.3) - [CVE-2026-65456](https://insights.sbomify.com/CVE-2026-65456/): WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3) - [CVE-2026-65455](https://insights.sbomify.com/CVE-2026-65455/): WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability (critical 9.1) - [CVE-2026-65454](https://insights.sbomify.com/CVE-2026-65454/): WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability (high 8.5) - [CVE-2026-65453](https://insights.sbomify.com/CVE-2026-65453/): WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65452](https://insights.sbomify.com/CVE-2026-65452/): WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-65451](https://insights.sbomify.com/CVE-2026-65451/): WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability (high 8.5) - [CVE-2026-65450](https://insights.sbomify.com/CVE-2026-65450/): WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability (high 8.5) - [CVE-2026-65449](https://insights.sbomify.com/CVE-2026-65449/): WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65448](https://insights.sbomify.com/CVE-2026-65448/): WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-65447](https://insights.sbomify.com/CVE-2026-65447/): WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65446](https://insights.sbomify.com/CVE-2026-65446/): WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65445](https://insights.sbomify.com/CVE-2026-65445/): WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability (medium 6.5) - [CVE-2026-65443](https://insights.sbomify.com/CVE-2026-65443/): WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65442](https://insights.sbomify.com/CVE-2026-65442/): WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability (high 7.2) - [CVE-2026-65441](https://insights.sbomify.com/CVE-2026-65441/): WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65440](https://insights.sbomify.com/CVE-2026-65440/): WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-6544](https://insights.sbomify.com/CVE-2026-6544/): Multiple Vulnerabilities in IBM Concert Software (medium 6.2) - [CVE-2026-65439](https://insights.sbomify.com/CVE-2026-65439/): WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65438](https://insights.sbomify.com/CVE-2026-65438/): WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65437](https://insights.sbomify.com/CVE-2026-65437/): WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-65436](https://insights.sbomify.com/CVE-2026-65436/): WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability (medium 6.8) - [CVE-2026-65435](https://insights.sbomify.com/CVE-2026-65435/): WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability (medium 6.5) - [CVE-2026-65434](https://insights.sbomify.com/CVE-2026-65434/): WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerability (medium 6.5) - [CVE-2026-65433](https://insights.sbomify.com/CVE-2026-65433/): Missing authorization in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg (medium 6.5) - [CVE-2026-65432](https://insights.sbomify.com/CVE-2026-65432/): Apache CXF: XXE via WSDL/XSD import parsing (high 7.5) - [CVE-2026-65431](https://insights.sbomify.com/CVE-2026-65431/): Joomla Extension - regularlabs.com - Zipslip in GeoIP extension (critical 9.8) - [CVE-2026-65430](https://insights.sbomify.com/CVE-2026-65430/): Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension (high 7.5) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/462/