Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 490 of 1013.
- CVE-2026-62079 WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62078 WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62077 WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability
- CVE-2026-62076 WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability
- CVE-2026-62075 WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability
- CVE-2026-62074 WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability
- CVE-2026-62073 WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability
- CVE-2026-62072 WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability
- CVE-2026-62071 WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability
- CVE-2026-62070 WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability
- CVE-2026-62069 WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability
- CVE-2026-62068 WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability
- CVE-2026-62067 WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability
- CVE-2026-62066 WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability
- CVE-2026-62065 WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability
- CVE-2026-62064 WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-62063 WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability
- CVE-2026-62062 WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-62061 WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-62060 WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability
- CVE-2026-6206 Information disclosure in MW WP Form
- CVE-2026-62059 WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
- CVE-2026-62058 WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability
- CVE-2026-62054 WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability
- CVE-2026-62053 WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability
- CVE-2026-62052 WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability
- CVE-2026-62051 WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability
- CVE-2026-62050 WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability
- CVE-2026-6205 Path traversal in DiskStation Manager (DSM)
- CVE-2026-62049 WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62046 WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability
- CVE-2026-62045 WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability
- CVE-2026-62044 WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability
- CVE-2026-62043 WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability
- CVE-2026-62042 WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability
- CVE-2026-62041 WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability
- CVE-2026-62040 WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability
- CVE-2026-6204 LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write
- CVE-2026-62039 WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62038 WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability
- CVE-2026-62037 WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62036 WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability
- CVE-2026-62035 WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability
- CVE-2026-62034 Cross-site scripting in Before After Image Comparison – Image comparison for WP
- CVE-2026-62033 WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability
- CVE-2026-62032 WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability
- CVE-2026-62031 WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability
- CVE-2026-62030 WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-6203 User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter
- CVE-2026-62029 WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62028 Missing authorization in Before After Image Comparison – Image comparison for WP
- CVE-2026-62027 WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62026 WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-62025 WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability
- CVE-2026-62024 WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability
- CVE-2026-62022 WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability
- CVE-2026-62021 WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability
- CVE-2026-62020 WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability
- CVE-2026-6202 code-projects Easy Blog Site post.php sql injection
- CVE-2026-62018 WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability
- CVE-2026-62017 WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability
- CVE-2026-62016 WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability
- CVE-2026-62015 WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability
- CVE-2026-62014 WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability
- CVE-2026-62013 WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability
- CVE-2026-62012 WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability
- CVE-2026-62011 WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability
- CVE-2026-62010 WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability
- CVE-2026-6201 CodeAstro Online Job Portal Delete Job Posting job-delete.php access control
- CVE-2026-62009 WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability
- CVE-2026-62008 WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability
- CVE-2026-62006 WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability
- CVE-2026-62005 WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability
- CVE-2026-62004 WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability
- CVE-2026-62003 WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability
- CVE-2026-62002 WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability
- CVE-2026-62001 WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability
- CVE-2026-6200 Tenda F456 webtypelibrary formwebtypelibrary stack-based overflow
- CVE-2026-61998 WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability
- CVE-2026-61997 WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability
- CVE-2026-61996 WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability
- CVE-2026-61995 WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61994 WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability
- CVE-2026-61993 WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61992 WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability
- CVE-2026-61991 WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability
- CVE-2026-6199 Tenda F456 qossetting fromqossetting stack-based overflow
- CVE-2026-61989 WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61988 WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61986 WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61985 WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability
- CVE-2026-61984 WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability
- CVE-2026-61983 WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability
- CVE-2026-61982 WordPress SiteGuard WP Plugin plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-61981 WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-61980 WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability
- CVE-2026-6198 Tenda F456 NatStaticSetting fromNatStaticSetting stack-based overflow
- CVE-2026-61979 WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability
- CVE-2026-61978 WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability
- CVE-2026-61977 WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability