# Vulnerabilities published in 2026


- [CVE-2026-62079](https://insights.sbomify.com/CVE-2026-62079/): WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-62078](https://insights.sbomify.com/CVE-2026-62078/): WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-62077](https://insights.sbomify.com/CVE-2026-62077/): WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62076](https://insights.sbomify.com/CVE-2026-62076/): WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62075](https://insights.sbomify.com/CVE-2026-62075/): WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62074](https://insights.sbomify.com/CVE-2026-62074/): WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62073](https://insights.sbomify.com/CVE-2026-62073/): WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-62072](https://insights.sbomify.com/CVE-2026-62072/): WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability (high 8.8)
- [CVE-2026-62071](https://insights.sbomify.com/CVE-2026-62071/): WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-62070](https://insights.sbomify.com/CVE-2026-62070/): WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62069](https://insights.sbomify.com/CVE-2026-62069/): WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62068](https://insights.sbomify.com/CVE-2026-62068/): WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62067](https://insights.sbomify.com/CVE-2026-62067/): WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62066](https://insights.sbomify.com/CVE-2026-62066/): WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62065](https://insights.sbomify.com/CVE-2026-62065/): WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62064](https://insights.sbomify.com/CVE-2026-62064/): WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-62063](https://insights.sbomify.com/CVE-2026-62063/): WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-62062](https://insights.sbomify.com/CVE-2026-62062/): WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-62061](https://insights.sbomify.com/CVE-2026-62061/): WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-62060](https://insights.sbomify.com/CVE-2026-62060/): WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-6206](https://insights.sbomify.com/CVE-2026-6206/): Information disclosure in MW WP Form (medium 5.3)
- [CVE-2026-62059](https://insights.sbomify.com/CVE-2026-62059/): WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-62058](https://insights.sbomify.com/CVE-2026-62058/): WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-62054](https://insights.sbomify.com/CVE-2026-62054/): WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62053](https://insights.sbomify.com/CVE-2026-62053/): WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62052](https://insights.sbomify.com/CVE-2026-62052/): WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62051](https://insights.sbomify.com/CVE-2026-62051/): WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62050](https://insights.sbomify.com/CVE-2026-62050/): WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-6205](https://insights.sbomify.com/CVE-2026-6205/): Path traversal in DiskStation Manager (DSM) (high 8.1)
- [CVE-2026-62049](https://insights.sbomify.com/CVE-2026-62049/): WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-62046](https://insights.sbomify.com/CVE-2026-62046/): WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62045](https://insights.sbomify.com/CVE-2026-62045/): WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62044](https://insights.sbomify.com/CVE-2026-62044/): WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-62043](https://insights.sbomify.com/CVE-2026-62043/): WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-62042](https://insights.sbomify.com/CVE-2026-62042/): WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-62041](https://insights.sbomify.com/CVE-2026-62041/): WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-62040](https://insights.sbomify.com/CVE-2026-62040/): WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-6204](https://insights.sbomify.com/CVE-2026-6204/): LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write (high 8.5)
- [CVE-2026-62039](https://insights.sbomify.com/CVE-2026-62039/): WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-62038](https://insights.sbomify.com/CVE-2026-62038/): WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability (high 7.3)
- [CVE-2026-62037](https://insights.sbomify.com/CVE-2026-62037/): WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-62036](https://insights.sbomify.com/CVE-2026-62036/): WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-62035](https://insights.sbomify.com/CVE-2026-62035/): WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-62034](https://insights.sbomify.com/CVE-2026-62034/): Cross-site scripting in Before After Image Comparison – Image comparison for WP (high 7.1)
- [CVE-2026-62033](https://insights.sbomify.com/CVE-2026-62033/): WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability (high 7.6)
- [CVE-2026-62032](https://insights.sbomify.com/CVE-2026-62032/): WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability (critical 9.8)
- [CVE-2026-62031](https://insights.sbomify.com/CVE-2026-62031/): WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-62030](https://insights.sbomify.com/CVE-2026-62030/): WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-6203](https://insights.sbomify.com/CVE-2026-6203/): User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter (medium 6.1)
- [CVE-2026-62029](https://insights.sbomify.com/CVE-2026-62029/): WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-62028](https://insights.sbomify.com/CVE-2026-62028/): Missing authorization in Before After Image Comparison – Image comparison for WP (medium 5.4)
- [CVE-2026-62027](https://insights.sbomify.com/CVE-2026-62027/): WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-62026](https://insights.sbomify.com/CVE-2026-62026/): WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2026-62025](https://insights.sbomify.com/CVE-2026-62025/): WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability (critical 9.0)
- [CVE-2026-62024](https://insights.sbomify.com/CVE-2026-62024/): WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-62022](https://insights.sbomify.com/CVE-2026-62022/): WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-62021](https://insights.sbomify.com/CVE-2026-62021/): WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-62020](https://insights.sbomify.com/CVE-2026-62020/): WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-6202](https://insights.sbomify.com/CVE-2026-6202/): code-projects Easy Blog Site post.php sql injection (medium 5.3)
- [CVE-2026-62018](https://insights.sbomify.com/CVE-2026-62018/): WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62017](https://insights.sbomify.com/CVE-2026-62017/): WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62016](https://insights.sbomify.com/CVE-2026-62016/): WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62015](https://insights.sbomify.com/CVE-2026-62015/): WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62014](https://insights.sbomify.com/CVE-2026-62014/): WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62013](https://insights.sbomify.com/CVE-2026-62013/): WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62012](https://insights.sbomify.com/CVE-2026-62012/): WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62011](https://insights.sbomify.com/CVE-2026-62011/): WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62010](https://insights.sbomify.com/CVE-2026-62010/): WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-6201](https://insights.sbomify.com/CVE-2026-6201/): CodeAstro Online Job Portal Delete Job Posting job-delete.php access control (medium 5.3)
- [CVE-2026-62009](https://insights.sbomify.com/CVE-2026-62009/): WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62008](https://insights.sbomify.com/CVE-2026-62008/): WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62006](https://insights.sbomify.com/CVE-2026-62006/): WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62005](https://insights.sbomify.com/CVE-2026-62005/): WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62004](https://insights.sbomify.com/CVE-2026-62004/): WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62003](https://insights.sbomify.com/CVE-2026-62003/): WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62002](https://insights.sbomify.com/CVE-2026-62002/): WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62001](https://insights.sbomify.com/CVE-2026-62001/): WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-6200](https://insights.sbomify.com/CVE-2026-6200/): Tenda F456 webtypelibrary formwebtypelibrary stack-based overflow (high 8.7)
- [CVE-2026-61998](https://insights.sbomify.com/CVE-2026-61998/): WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-61997](https://insights.sbomify.com/CVE-2026-61997/): WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-61996](https://insights.sbomify.com/CVE-2026-61996/): WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-61995](https://insights.sbomify.com/CVE-2026-61995/): WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61994](https://insights.sbomify.com/CVE-2026-61994/): WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-61993](https://insights.sbomify.com/CVE-2026-61993/): WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61992](https://insights.sbomify.com/CVE-2026-61992/): WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-61991](https://insights.sbomify.com/CVE-2026-61991/): WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-6199](https://insights.sbomify.com/CVE-2026-6199/): Tenda F456 qossetting fromqossetting stack-based overflow (high 8.7)
- [CVE-2026-61989](https://insights.sbomify.com/CVE-2026-61989/): WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61988](https://insights.sbomify.com/CVE-2026-61988/): WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61986](https://insights.sbomify.com/CVE-2026-61986/): WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61985](https://insights.sbomify.com/CVE-2026-61985/): WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-61984](https://insights.sbomify.com/CVE-2026-61984/): WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-61983](https://insights.sbomify.com/CVE-2026-61983/): WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-61982](https://insights.sbomify.com/CVE-2026-61982/): WordPress SiteGuard WP Plugin plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61981](https://insights.sbomify.com/CVE-2026-61981/): WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-61980](https://insights.sbomify.com/CVE-2026-61980/): WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2026-6198](https://insights.sbomify.com/CVE-2026-6198/): Tenda F456 NatStaticSetting fromNatStaticSetting stack-based overflow (high 8.7)
- [CVE-2026-61979](https://insights.sbomify.com/CVE-2026-61979/): WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability (high 8.1)
- [CVE-2026-61978](https://insights.sbomify.com/CVE-2026-61978/): WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-61977](https://insights.sbomify.com/CVE-2026-61977/): WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/490/