# Vulnerabilities published in 2026


- [CVE-2026-57392](https://insights.sbomify.com/CVE-2026-57392/): WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57391](https://insights.sbomify.com/CVE-2026-57391/): WordPress Loops & Logic plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57390](https://insights.sbomify.com/CVE-2026-57390/): WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-5739](https://insights.sbomify.com/CVE-2026-5739/): PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injection (medium 6.9)
- [CVE-2026-57389](https://insights.sbomify.com/CVE-2026-57389/): WordPress Groundhogg plugin <= 4.4.1 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2026-57388](https://insights.sbomify.com/CVE-2026-57388/): WordPress Hydra Booking plugin <= 1.1.44 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57387](https://insights.sbomify.com/CVE-2026-57387/): WordPress picu plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57386](https://insights.sbomify.com/CVE-2026-57386/): WordPress aBlocks plugin < 2.9.1 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-57385](https://insights.sbomify.com/CVE-2026-57385/): WordPress Vitepos plugin <= 3.4.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57384](https://insights.sbomify.com/CVE-2026-57384/): WordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57383](https://insights.sbomify.com/CVE-2026-57383/): WordPress JobSearch plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57382](https://insights.sbomify.com/CVE-2026-57382/): WordPress Simple File List plugin <= 6.3.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57381](https://insights.sbomify.com/CVE-2026-57381/): WordPress PropertyHive plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57380](https://insights.sbomify.com/CVE-2026-57380/): WordPress Extensions for Leaflet Map plugin <= 5.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-5738](https://insights.sbomify.com/CVE-2026-5738/): Reflected XSS in BilPark's DoXBASE (medium 6.1)
- [CVE-2026-57379](https://insights.sbomify.com/CVE-2026-57379/): WordPress FormyChat plugin <= 2.15.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57378](https://insights.sbomify.com/CVE-2026-57378/): WordPress Advanced Forms plugin <= 1.9.3.7 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-57377](https://insights.sbomify.com/CVE-2026-57377/): WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57376](https://insights.sbomify.com/CVE-2026-57376/): WordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57375](https://insights.sbomify.com/CVE-2026-57375/): WordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57374](https://insights.sbomify.com/CVE-2026-57374/): WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57373](https://insights.sbomify.com/CVE-2026-57373/): WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57372](https://insights.sbomify.com/CVE-2026-57372/): WordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-57371](https://insights.sbomify.com/CVE-2026-57371/): WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-57370](https://insights.sbomify.com/CVE-2026-57370/): Cross-site scripting in Visitor Traffic Real Time Statistics Pro (high 7.1)
- [CVE-2026-5737](https://insights.sbomify.com/CVE-2026-5737/): Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route (medium 6.5)
- [CVE-2026-57369](https://insights.sbomify.com/CVE-2026-57369/): WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57368](https://insights.sbomify.com/CVE-2026-57368/): WordPress Jobmonster theme <= 4.8.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57367](https://insights.sbomify.com/CVE-2026-57367/): WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-57366](https://insights.sbomify.com/CVE-2026-57366/): WordPress WPAdverts plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57365](https://insights.sbomify.com/CVE-2026-57365/): WordPress reCAPTCHA (v2 & v3) for Asgaros Forum plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57364](https://insights.sbomify.com/CVE-2026-57364/): Business logic in Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More (medium 6.5)
- [CVE-2026-57363](https://insights.sbomify.com/CVE-2026-57363/): WordPress ChatBot plugin <= 8.3.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57362](https://insights.sbomify.com/CVE-2026-57362/): WordPress ChatBot plugin <= 8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57361](https://insights.sbomify.com/CVE-2026-57361/): WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57360](https://insights.sbomify.com/CVE-2026-57360/): WordPress eCommerce Product Catalog plugin <= 3.5.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-5736](https://insights.sbomify.com/CVE-2026-5736/): PowerJob detailPlus Endpoint InstanceController.java sql injection (medium 6.9)
- [CVE-2026-57359](https://insights.sbomify.com/CVE-2026-57359/): WordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57358](https://insights.sbomify.com/CVE-2026-57358/): WordPress Customize My Account for WooCommerce plugin <= 4.3.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57357](https://insights.sbomify.com/CVE-2026-57357/): WordPress Search Atlas SEO plugin <= 2.6.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57356](https://insights.sbomify.com/CVE-2026-57356/): WordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57355](https://insights.sbomify.com/CVE-2026-57355/): WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57354](https://insights.sbomify.com/CVE-2026-57354/): WordPress JetReviews plugin <= 3.0.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57353](https://insights.sbomify.com/CVE-2026-57353/): WordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57352](https://insights.sbomify.com/CVE-2026-57352/): Auth bypass in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce (medium 4.8)
- [CVE-2026-57351](https://insights.sbomify.com/CVE-2026-57351/): WordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57350](https://insights.sbomify.com/CVE-2026-57350/): WordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-5735](https://insights.sbomify.com/CVE-2026-5735/): Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2 (high 8.1)
- [CVE-2026-57349](https://insights.sbomify.com/CVE-2026-57349/): WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57348](https://insights.sbomify.com/CVE-2026-57348/): WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-57347](https://insights.sbomify.com/CVE-2026-57347/): WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-57346](https://insights.sbomify.com/CVE-2026-57346/): WordPress Embed Privacy plugin <= 1.12.3 - Arbitrary File Deletion vulnerability (high 7.1)
- [CVE-2026-57345](https://insights.sbomify.com/CVE-2026-57345/): WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57344](https://insights.sbomify.com/CVE-2026-57344/): WordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57343](https://insights.sbomify.com/CVE-2026-57343/): WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57342](https://insights.sbomify.com/CVE-2026-57342/): WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57341](https://insights.sbomify.com/CVE-2026-57341/): Missing authorization in Colissimo Officiel : Méthodes de livraison pour WooCommerce (medium 6.5)
- [CVE-2026-57340](https://insights.sbomify.com/CVE-2026-57340/): WordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-5734](https://insights.sbomify.com/CVE-2026-5734/): Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (high 8.1)
- [CVE-2026-57339](https://insights.sbomify.com/CVE-2026-57339/): WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability (medium 6.6)
- [CVE-2026-57338](https://insights.sbomify.com/CVE-2026-57338/): WordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57337](https://insights.sbomify.com/CVE-2026-57337/): WordPress Landing Page Builder plugin <= 1.5.3.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57336](https://insights.sbomify.com/CVE-2026-57336/): WordPress Jobify theme <= 4.3.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57335](https://insights.sbomify.com/CVE-2026-57335/): WordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57334](https://insights.sbomify.com/CVE-2026-57334/): WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57333](https://insights.sbomify.com/CVE-2026-57333/): WordPress Link Whisper Free plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57332](https://insights.sbomify.com/CVE-2026-57332/): WordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-57331](https://insights.sbomify.com/CVE-2026-57331/): WordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deletion vulnerability (critical 9.9)
- [CVE-2026-57330](https://insights.sbomify.com/CVE-2026-57330/): WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-5733](https://insights.sbomify.com/CVE-2026-5733/): Incorrect boundary conditions in the Graphics: WebGPU component (high 8.8)
- [CVE-2026-57329](https://insights.sbomify.com/CVE-2026-57329/): WordPress WooCommerce Designer Pro plugin <= 1.9.34 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57328](https://insights.sbomify.com/CVE-2026-57328/): WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57327](https://insights.sbomify.com/CVE-2026-57327/): WordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-57326](https://insights.sbomify.com/CVE-2026-57326/): WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57325](https://insights.sbomify.com/CVE-2026-57325/): WordPress NanoMag theme <= 1.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57324](https://insights.sbomify.com/CVE-2026-57324/): WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57323](https://insights.sbomify.com/CVE-2026-57323/): WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability (medium 5.8)
- [CVE-2026-57322](https://insights.sbomify.com/CVE-2026-57322/): WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57321](https://insights.sbomify.com/CVE-2026-57321/): WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vulnerability (high 7.1)
- [CVE-2026-57320](https://insights.sbomify.com/CVE-2026-57320/): WordPress BEAR plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-5732](https://insights.sbomify.com/CVE-2026-5732/): Incorrect boundary conditions, integer overflow in the Graphics: Text component (high 8.8)
- [CVE-2026-57319](https://insights.sbomify.com/CVE-2026-57319/): WordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57318](https://insights.sbomify.com/CVE-2026-57318/): WordPress Site Reviews plugin <= 8.0.11 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-57317](https://insights.sbomify.com/CVE-2026-57317/): WordPress Simply Schedule Appointments plugin <= 1.6.12.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57316](https://insights.sbomify.com/CVE-2026-57316/): WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-57315](https://insights.sbomify.com/CVE-2026-57315/): WordPress Blocksy Companion Pro plugin <= 2.1.45 - Remote Code Execution (RCE) vulnerability (high 8.5)
- [CVE-2026-57314](https://insights.sbomify.com/CVE-2026-57314/): WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57313](https://insights.sbomify.com/CVE-2026-57313/): WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57312](https://insights.sbomify.com/CVE-2026-57312/): WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57311](https://insights.sbomify.com/CVE-2026-57311/): Unrestricted Upload of File with Dangerous Type in Windu CMS (medium 5.3)
- [CVE-2026-57310](https://insights.sbomify.com/CVE-2026-57310/): Weak password hashing in Windu CMS (medium 6.3)
- [CVE-2026-5731](https://insights.sbomify.com/CVE-2026-5731/): Memory corruption in Firefox (critical 9.8)
- [CVE-2026-57309](https://insights.sbomify.com/CVE-2026-57309/): Blind SQL Injection in Windu CMS (critical 9.3)
- [CVE-2026-57308](https://insights.sbomify.com/CVE-2026-57308/): Apache Syncope: SQL injection vulnerability in Audit Events search (critical 9.8)
- [CVE-2026-57307](https://insights.sbomify.com/CVE-2026-57307/): Jenkins Zowe zDevOps Plugin has a missing permission check (medium 4.2)
- [CVE-2026-57306](https://insights.sbomify.com/CVE-2026-57306/): Jenkins Zowe zDevOps Plugin has a CSRF vulnerability (medium 4.2)
- [CVE-2026-57305](https://insights.sbomify.com/CVE-2026-57305/): Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-57304](https://insights.sbomify.com/CVE-2026-57304/): Jenkins Assembla Plugin has a missing permission check (medium 5.4)
- [CVE-2026-57303](https://insights.sbomify.com/CVE-2026-57303/): Jenkins Assembla Plugin has an XXE vulnerability (high 7.1)
- [CVE-2026-57302](https://insights.sbomify.com/CVE-2026-57302/): Jenkins FitNesse Plugin stores passwords unencrypted (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/527/