# Vulnerabilities published in 2026


- [CVE-2026-57757](https://insights.sbomify.com/CVE-2026-57757/): WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2026-57756](https://insights.sbomify.com/CVE-2026-57756/): WordPress nicen-localize-image plugin <= 1.4.9 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57755](https://insights.sbomify.com/CVE-2026-57755/): WordPress Mosaic Gallery &#8211; Advanced Gallery plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57754](https://insights.sbomify.com/CVE-2026-57754/): WordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57753](https://insights.sbomify.com/CVE-2026-57753/): WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.1.5 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-57752](https://insights.sbomify.com/CVE-2026-57752/): WordPress iNET Webkit plugin 1.2.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57751](https://insights.sbomify.com/CVE-2026-57751/): WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability (high 8.1)
- [CVE-2026-57750](https://insights.sbomify.com/CVE-2026-57750/): WordPress ez Form Calculator Premium plugin <= 2.14.1.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-57749](https://insights.sbomify.com/CVE-2026-57749/): WordPress SportsPress Pro plugin <= 2.7.29 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57748](https://insights.sbomify.com/CVE-2026-57748/): WordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57747](https://insights.sbomify.com/CVE-2026-57747/): WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2026-57746](https://insights.sbomify.com/CVE-2026-57746/): WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-57745](https://insights.sbomify.com/CVE-2026-57745/): WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57744](https://insights.sbomify.com/CVE-2026-57744/): WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-57743](https://insights.sbomify.com/CVE-2026-57743/): WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-57742](https://insights.sbomify.com/CVE-2026-57742/): WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57741](https://insights.sbomify.com/CVE-2026-57741/): WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57740](https://insights.sbomify.com/CVE-2026-57740/): WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-5774](https://insights.sbomify.com/CVE-2026-5774/): Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map (medium 6.1)
- [CVE-2026-57739](https://insights.sbomify.com/CVE-2026-57739/): WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-57738](https://insights.sbomify.com/CVE-2026-57738/): WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-57737](https://insights.sbomify.com/CVE-2026-57737/): WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57736](https://insights.sbomify.com/CVE-2026-57736/): WordPress HubSpot plugin <= 11.3.51 - Sensitive Data Exposure vulnerability (high 7.4)
- [CVE-2026-57735](https://insights.sbomify.com/CVE-2026-57735/): WordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57734](https://insights.sbomify.com/CVE-2026-57734/): WordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57733](https://insights.sbomify.com/CVE-2026-57733/): WordPress tagDiv Cloud Library plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57732](https://insights.sbomify.com/CVE-2026-57732/): WordPress tagDiv Opt-In Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57731](https://insights.sbomify.com/CVE-2026-57731/): WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57730](https://insights.sbomify.com/CVE-2026-57730/): WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-5773](https://insights.sbomify.com/CVE-2026-5773/): wrong reuse of SMB connection (high 7.5)
- [CVE-2026-57729](https://insights.sbomify.com/CVE-2026-57729/): WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-57728](https://insights.sbomify.com/CVE-2026-57728/): WordPress Flatsome theme <= 3.20.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57727](https://insights.sbomify.com/CVE-2026-57727/): WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-57726](https://insights.sbomify.com/CVE-2026-57726/): WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-57725](https://insights.sbomify.com/CVE-2026-57725/): WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57724](https://insights.sbomify.com/CVE-2026-57724/): WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-57723](https://insights.sbomify.com/CVE-2026-57723/): WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability (high 7.4)
- [CVE-2026-57722](https://insights.sbomify.com/CVE-2026-57722/): WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-57721](https://insights.sbomify.com/CVE-2026-57721/): WordPress ApplyOnline plugin <= 2.6.7.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-57720](https://insights.sbomify.com/CVE-2026-57720/): WordPress ThumbPress plugin <= 6.3.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-5772](https://insights.sbomify.com/CVE-2026-5772/): MatchDomainName 1-Byte Stack Buffer Over-Read in Hostname Validation (low 2.1)
- [CVE-2026-57719](https://insights.sbomify.com/CVE-2026-57719/): WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2026-57718](https://insights.sbomify.com/CVE-2026-57718/): Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (high 7.1)
- [CVE-2026-57717](https://insights.sbomify.com/CVE-2026-57717/): WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57716](https://insights.sbomify.com/CVE-2026-57716/): WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability (medium 5.3)
- [CVE-2026-57715](https://insights.sbomify.com/CVE-2026-57715/): WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57714](https://insights.sbomify.com/CVE-2026-57714/): WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-57713](https://insights.sbomify.com/CVE-2026-57713/): WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-57712](https://insights.sbomify.com/CVE-2026-57712/): WordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57711](https://insights.sbomify.com/CVE-2026-57711/): WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57710](https://insights.sbomify.com/CVE-2026-57710/): WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-57709](https://insights.sbomify.com/CVE-2026-57709/): WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2026-57708](https://insights.sbomify.com/CVE-2026-57708/): WordPress Contact Form Entries plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57707](https://insights.sbomify.com/CVE-2026-57707/): WordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-57706](https://insights.sbomify.com/CVE-2026-57706/): WordPress Dokan plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57705](https://insights.sbomify.com/CVE-2026-57705/): WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-57704](https://insights.sbomify.com/CVE-2026-57704/): WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57703](https://insights.sbomify.com/CVE-2026-57703/): WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-57702](https://insights.sbomify.com/CVE-2026-57702/): WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-57701](https://insights.sbomify.com/CVE-2026-57701/): WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57700](https://insights.sbomify.com/CVE-2026-57700/): WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2026-57699](https://insights.sbomify.com/CVE-2026-57699/): WordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57698](https://insights.sbomify.com/CVE-2026-57698/): WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-57697](https://insights.sbomify.com/CVE-2026-57697/): WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-57696](https://insights.sbomify.com/CVE-2026-57696/): WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability (high 7.1)
- [CVE-2026-57695](https://insights.sbomify.com/CVE-2026-57695/): WordPress Document Gallery plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57694](https://insights.sbomify.com/CVE-2026-57694/): WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-57693](https://insights.sbomify.com/CVE-2026-57693/): WordPress Ad Inserter plugin <= 2.8.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57692](https://insights.sbomify.com/CVE-2026-57692/): WordPress PrivateContent plugin <= 9.9.2 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-57691](https://insights.sbomify.com/CVE-2026-57691/): WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.89 - Cross Site Scripting (XSS) vulnerability (medium 5.8)
- [CVE-2026-57690](https://insights.sbomify.com/CVE-2026-57690/): WordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-5769](https://insights.sbomify.com/CVE-2026-5769/): Information disclosure in Brocade SANnav (medium 5.6)
- [CVE-2026-57689](https://insights.sbomify.com/CVE-2026-57689/): WordPress Werkstatt theme <= 4.7.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-57688](https://insights.sbomify.com/CVE-2026-57688/): WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability (high 8.2)
- [CVE-2026-57687](https://insights.sbomify.com/CVE-2026-57687/): WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57686](https://insights.sbomify.com/CVE-2026-57686/): WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57685](https://insights.sbomify.com/CVE-2026-57685/): WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-57684](https://insights.sbomify.com/CVE-2026-57684/): WordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57683](https://insights.sbomify.com/CVE-2026-57683/): WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-57682](https://insights.sbomify.com/CVE-2026-57682/): WordPress Simple Link Directory plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57681](https://insights.sbomify.com/CVE-2026-57681/): WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2026-57680](https://insights.sbomify.com/CVE-2026-57680/): WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-5768](https://insights.sbomify.com/CVE-2026-5768/): Fourth Frontier Frontier X Mobile Application, Frontier X2 Missing Authentication for Critical Function (high 8.8)
- [CVE-2026-57679](https://insights.sbomify.com/CVE-2026-57679/): WordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-57678](https://insights.sbomify.com/CVE-2026-57678/): WordPress Slider Revolution plugin 7.0.0-7.0.16 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57677](https://insights.sbomify.com/CVE-2026-57677/): WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-57676](https://insights.sbomify.com/CVE-2026-57676/): WordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-57675](https://insights.sbomify.com/CVE-2026-57675/): WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57674](https://insights.sbomify.com/CVE-2026-57674/): WordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57673](https://insights.sbomify.com/CVE-2026-57673/): WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57672](https://insights.sbomify.com/CVE-2026-57672/): WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57671](https://insights.sbomify.com/CVE-2026-57671/): WordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57670](https://insights.sbomify.com/CVE-2026-57670/): WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-5767](https://insights.sbomify.com/CVE-2026-5767/): SlideShowPro SC <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute (medium 6.4)
- [CVE-2026-57669](https://insights.sbomify.com/CVE-2026-57669/): WordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57668](https://insights.sbomify.com/CVE-2026-57668/): WordPress NEX-Forms plugin <= 9.2.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57667](https://insights.sbomify.com/CVE-2026-57667/): WordPress Groundhogg plugin <= 4.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57665](https://insights.sbomify.com/CVE-2026-57665/): WordPress GravityView plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-57664](https://insights.sbomify.com/CVE-2026-57664/): WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.1.6 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-57663](https://insights.sbomify.com/CVE-2026-57663/): WordPress Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.2.7 - SQL Injection vulnerability (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/524/