Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 527 of 1013.
- CVE-2026-57392 WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability
- CVE-2026-57391 WordPress Loops & Logic plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57390 WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerability
- CVE-2026-5739 PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection
- CVE-2026-57389 WordPress Groundhogg plugin <= 4.4.1 - Arbitrary File Deletion vulnerability
- CVE-2026-57388 WordPress Hydra Booking plugin <= 1.1.44 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57387 WordPress picu plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57386 WordPress aBlocks plugin < 2.9.1 - Privilege Escalation vulnerability
- CVE-2026-57385 WordPress Vitepos plugin <= 3.4.2 - SQL Injection vulnerability
- CVE-2026-57384 WordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57383 WordPress JobSearch plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57382 WordPress Simple File List plugin <= 6.3.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57381 WordPress PropertyHive plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57380 WordPress Extensions for Leaflet Map plugin <= 5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-5738 Reflected XSS in BilPark's DoXBASE
- CVE-2026-57379 WordPress FormyChat plugin <= 2.15.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57378 WordPress Advanced Forms plugin <= 1.9.3.7 - Broken Access Control vulnerability
- CVE-2026-57377 WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability
- CVE-2026-57376 WordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57375 WordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerability
- CVE-2026-57374 WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57373 WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57372 WordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-57371 WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability
- CVE-2026-57370 Cross-site scripting in Visitor Traffic Real Time Statistics Pro
- CVE-2026-5737 Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route
- CVE-2026-57369 WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57368 WordPress Jobmonster theme <= 4.8.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57367 WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability
- CVE-2026-57366 WordPress WPAdverts plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57365 WordPress reCAPTCHA (v2 & v3) for Asgaros Forum plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57364 Business logic in Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More
- CVE-2026-57363 WordPress ChatBot plugin <= 8.3.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57362 WordPress ChatBot plugin <= 8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57361 WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57360 WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-5736 PowerJob detailPlus Endpoint InstanceController.java sql injection
- CVE-2026-57359 WordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57358 WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57357 WordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57356 WordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57355 WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability
- CVE-2026-57354 WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57353 WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability
- CVE-2026-57352 Auth bypass in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
- CVE-2026-57351 WordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57350 WordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-5735 Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2
- CVE-2026-57349 WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57348 WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-57347 WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability
- CVE-2026-57346 WordPress Embed Privacy plugin <= 1.12.3 - Arbitrary File Deletion vulnerability
- CVE-2026-57345 WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57344 WordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57343 WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57342 WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57341 Missing authorization in Colissimo Officiel : Méthodes de livraison pour WooCommerce
- CVE-2026-57340 WordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control vulnerability
- CVE-2026-5734 Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2
- CVE-2026-57339 WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability
- CVE-2026-57338 WordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57337 WordPress Landing Page Builder plugin <= 1.5.3.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57336 WordPress Jobify theme <= 4.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57335 WordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability
- CVE-2026-57334 WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability
- CVE-2026-57333 WordPress Link Whisper Free plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57332 WordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerability
- CVE-2026-57331 WordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deletion vulnerability
- CVE-2026-57330 WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-5733 Incorrect boundary conditions in the Graphics: WebGPU component
- CVE-2026-57329 WordPress WooCommerce Designer Pro plugin <= 1.9.34 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57328 WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57327 WordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerability
- CVE-2026-57326 WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57325 WordPress NanoMag theme <= 1.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57324 WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability
- CVE-2026-57323 WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability
- CVE-2026-57322 WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57321 WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vulnerability
- CVE-2026-57320 WordPress BEAR plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-5732 Incorrect boundary conditions, integer overflow in the Graphics: Text component
- CVE-2026-57319 WordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57318 WordPress Site Reviews plugin <= 8.0.11 - Sensitive Data Exposure vulnerability
- CVE-2026-57317 WordPress Simply Schedule Appointments plugin <= 1.6.12.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57316 WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability
- CVE-2026-57315 WordPress Blocksy Companion Pro plugin <= 2.1.45 - Remote Code Execution (RCE) vulnerability
- CVE-2026-57314 WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57313 WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57312 WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-57311 Unrestricted Upload of File with Dangerous Type in Windu CMS
- CVE-2026-57310 Weak password hashing in Windu CMS
- CVE-2026-5731 Memory corruption in Firefox
- CVE-2026-57309 Blind SQL Injection in Windu CMS
- CVE-2026-57308 Apache Syncope: SQL injection vulnerability in Audit Events search
- CVE-2026-57307 Jenkins Zowe zDevOps Plugin has a missing permission check
- CVE-2026-57306 Jenkins Zowe zDevOps Plugin has a CSRF vulnerability
- CVE-2026-57305 Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability
- CVE-2026-57304 Jenkins Assembla Plugin has a missing permission check
- CVE-2026-57303 Jenkins Assembla Plugin has an XXE vulnerability
- CVE-2026-57302 Jenkins FitNesse Plugin stores passwords unencrypted