# Vulnerabilities published in 2026


- [CVE-2026-42716](https://insights.sbomify.com/CVE-2026-42716/): WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-42715](https://insights.sbomify.com/CVE-2026-42715/): WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42714](https://insights.sbomify.com/CVE-2026-42714/): WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-42713](https://insights.sbomify.com/CVE-2026-42713/): WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-42712](https://insights.sbomify.com/CVE-2026-42712/): WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-42711](https://insights.sbomify.com/CVE-2026-42711/): WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42710](https://insights.sbomify.com/CVE-2026-42710/): WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-4271](https://insights.sbomify.com/CVE-2026-4271/): Libsoup: libsoup: denial of service via use-after-free in http/2 server (medium 5.3)
- [CVE-2026-42709](https://insights.sbomify.com/CVE-2026-42709/): Cross-site scripting in Food Menu – Restaurant Menu & Online Ordering for WooCommerce (high 7.1)
- [CVE-2026-42708](https://insights.sbomify.com/CVE-2026-42708/): WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-42707](https://insights.sbomify.com/CVE-2026-42707/): WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-42706](https://insights.sbomify.com/CVE-2026-42706/): WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-42705](https://insights.sbomify.com/CVE-2026-42705/): WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-42704](https://insights.sbomify.com/CVE-2026-42704/): WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-42703](https://insights.sbomify.com/CVE-2026-42703/): WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-42702](https://insights.sbomify.com/CVE-2026-42702/): WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42701](https://insights.sbomify.com/CVE-2026-42701/): WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-42700](https://insights.sbomify.com/CVE-2026-42700/): WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-4270](https://insights.sbomify.com/CVE-2026-4270/): AWS API MCP File Access Restriction Bypass (medium 6.8)
- [CVE-2026-42699](https://insights.sbomify.com/CVE-2026-42699/): WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42698](https://insights.sbomify.com/CVE-2026-42698/): WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability (medium 5.3)
- [CVE-2026-42697](https://insights.sbomify.com/CVE-2026-42697/): WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42696](https://insights.sbomify.com/CVE-2026-42696/): WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-42695](https://insights.sbomify.com/CVE-2026-42695/): WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-42694](https://insights.sbomify.com/CVE-2026-42694/): WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability (medium 4.3)
- [CVE-2026-42693](https://insights.sbomify.com/CVE-2026-42693/): WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42692](https://insights.sbomify.com/CVE-2026-42692/): WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42691](https://insights.sbomify.com/CVE-2026-42691/): WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-42690](https://insights.sbomify.com/CVE-2026-42690/): WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-4269](https://insights.sbomify.com/CVE-2026-4269/): Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit (medium 5.8)
- [CVE-2026-42689](https://insights.sbomify.com/CVE-2026-42689/): WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability (low 3.7)
- [CVE-2026-42688](https://insights.sbomify.com/CVE-2026-42688/): WordPress Modula Image Gallery plugin <= 2.14.23 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-42687](https://insights.sbomify.com/CVE-2026-42687/): WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-42686](https://insights.sbomify.com/CVE-2026-42686/): WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42685](https://insights.sbomify.com/CVE-2026-42685/): WordPress WP Job Portal plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42684](https://insights.sbomify.com/CVE-2026-42684/): WordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42683](https://insights.sbomify.com/CVE-2026-42683/): WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42682](https://insights.sbomify.com/CVE-2026-42682/): WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability (critical 9.1)
- [CVE-2026-42681](https://insights.sbomify.com/CVE-2026-42681/): WordPress e2pdf plugin <= 1.32.14 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42680](https://insights.sbomify.com/CVE-2026-42680/): WordPress Contest Gallery Pro plugin <= 29.0.1 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-4268](https://insights.sbomify.com/CVE-2026-4268/): Cross-site scripting in WP Go Maps (formerly WP Google Maps) (medium 6.4)
- [CVE-2026-42679](https://insights.sbomify.com/CVE-2026-42679/): WordPress Classified Listing plugin <= 5.3.8 - Arbitrary File Download vulnerability (medium 6.5)
- [CVE-2026-42678](https://insights.sbomify.com/CVE-2026-42678/): WordPress GiveWP plugin <= 4.14.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42677](https://insights.sbomify.com/CVE-2026-42677/): WordPress WP Document Revisions plugin <= 3.8.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-42676](https://insights.sbomify.com/CVE-2026-42676/): WordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-42675](https://insights.sbomify.com/CVE-2026-42675/): WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-42674](https://insights.sbomify.com/CVE-2026-42674/): WordPress Advanced Access Manager plugin <= 7.1.0 - Bypass Vulnerability vulnerability (high 7.5)
- [CVE-2026-42673](https://insights.sbomify.com/CVE-2026-42673/): Information disclosure in Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity (high 7.5)
- [CVE-2026-42672](https://insights.sbomify.com/CVE-2026-42672/): WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42671](https://insights.sbomify.com/CVE-2026-42671/): WordPress GeoDirectory plugin <= 2.8.157 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-42670](https://insights.sbomify.com/CVE-2026-42670/): WordPress Five Star Restaurant Reservations plugin <= 2.7.14 - Payment Bypass vulnerability (high 7.5)
- [CVE-2026-4267](https://insights.sbomify.com/CVE-2026-4267/): Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI (high 7.2)
- [CVE-2026-42669](https://insights.sbomify.com/CVE-2026-42669/): WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-42668](https://insights.sbomify.com/CVE-2026-42668/): WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-42667](https://insights.sbomify.com/CVE-2026-42667/): WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-42666](https://insights.sbomify.com/CVE-2026-42666/): WordPress Salon booking system plugin <= 10.30.25 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-42665](https://insights.sbomify.com/CVE-2026-42665/): WordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42664](https://insights.sbomify.com/CVE-2026-42664/): Missing authorization in AI Product Search for WooCommerce &#8211; Motive Commerce Search (high 8.2)
- [CVE-2026-42663](https://insights.sbomify.com/CVE-2026-42663/): WordPress Simple Membership plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-42662](https://insights.sbomify.com/CVE-2026-42662/): WordPress Event Tickets plugin <= 5.27.5 - Bypass Vulnerability vulnerability (medium 6.5)
- [CVE-2026-42661](https://insights.sbomify.com/CVE-2026-42661/): WordPress WP Customer Area plugin <= 8.3.4 - Path Traversal vulnerability (high 8.8)
- [CVE-2026-42660](https://insights.sbomify.com/CVE-2026-42660/): WordPress Contest Gallery plugin <= 28.1.7 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-4266](https://insights.sbomify.com/CVE-2026-4266/): WatchGuard Firebox Insecure Deserialization in Fireware Access Portal (high 8.4)
- [CVE-2026-42659](https://insights.sbomify.com/CVE-2026-42659/): WordPress Advanced Form Integration plugin <= 1.126.12 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-42658](https://insights.sbomify.com/CVE-2026-42658/): WordPress Classified Listing plugin <= 5.3.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42657](https://insights.sbomify.com/CVE-2026-42657/): WordPress Contest Gallery plugin <= 28.1.7 - Other Vulnerability Type vulnerability (medium 6.5)
- [CVE-2026-42656](https://insights.sbomify.com/CVE-2026-42656/): WordPress Contest Gallery plugin <= 28.1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-42655](https://insights.sbomify.com/CVE-2026-42655/): WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability (high 7.5)
- [CVE-2026-42654](https://insights.sbomify.com/CVE-2026-42654/): WordPress Wallet System for WooCommerce plugin <= 2.7.5 - Broken Authentication vulnerability (high 7.1)
- [CVE-2026-42653](https://insights.sbomify.com/CVE-2026-42653/): WordPress SliceWP plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42652](https://insights.sbomify.com/CVE-2026-42652/): WordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42651](https://insights.sbomify.com/CVE-2026-42651/): WordPress Classified Listing plugin <= 5.3.9 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-42650](https://insights.sbomify.com/CVE-2026-42650/): WordPress AutomatorWP plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability (high 7.2)
- [CVE-2026-4265](https://insights.sbomify.com/CVE-2026-4265/): Guest user can upload files without permission across teams (medium 4.3)
- [CVE-2026-42649](https://insights.sbomify.com/CVE-2026-42649/): WordPress Favicon Rotator plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42648](https://insights.sbomify.com/CVE-2026-42648/): WordPress Spectra plugin <= 2.19.22 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-42647](https://insights.sbomify.com/CVE-2026-42647/): WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42646](https://insights.sbomify.com/CVE-2026-42646/): WordPress TaxoPress plugin <= 3.44.0 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-42645](https://insights.sbomify.com/CVE-2026-42645/): Cross-site request forgery in Barcode Scanner with Inventory & Order Manager (medium 4.3)
- [CVE-2026-42644](https://insights.sbomify.com/CVE-2026-42644/): WordPress BetterDocs plugin <= 4.3.10 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-42643](https://insights.sbomify.com/CVE-2026-42643/): WordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-42642](https://insights.sbomify.com/CVE-2026-42642/): WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-42641](https://insights.sbomify.com/CVE-2026-42641/): WordPress Share This Image plugin <= 2.14 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2026-42640](https://insights.sbomify.com/CVE-2026-42640/): WordPress Classified Listing plugin <= 5.3.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-4264](https://insights.sbomify.com/CVE-2026-4264/): Reflected Cross-Site Scripting in BeeTienda eCommerce platform (medium 5.1)
- [CVE-2026-42639](https://insights.sbomify.com/CVE-2026-42639/): WordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42638](https://insights.sbomify.com/CVE-2026-42638/): WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-42637](https://insights.sbomify.com/CVE-2026-42637/): WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability (medium 6.5)
- [CVE-2026-42636](https://insights.sbomify.com/CVE-2026-42636/): WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42635](https://insights.sbomify.com/CVE-2026-42635/): WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42634](https://insights.sbomify.com/CVE-2026-42634/): Cross-site scripting in Video Background Block – Use video as background in the section. (high 7.1)
- [CVE-2026-42633](https://insights.sbomify.com/CVE-2026-42633/): WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-42632](https://insights.sbomify.com/CVE-2026-42632/): WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42631](https://insights.sbomify.com/CVE-2026-42631/): WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42630](https://insights.sbomify.com/CVE-2026-42630/): WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-4263](https://insights.sbomify.com/CVE-2026-4263/): Incorrect authorization in HiJiffy Chatbot (medium 6.9)
- [CVE-2026-42629](https://insights.sbomify.com/CVE-2026-42629/): WordPress PowerPack Pro for Elementor plugin < v2.13.0 - Broken Authentication vulnerability (high 8.8)
- [CVE-2026-42627](https://insights.sbomify.com/CVE-2026-42627/): In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file (medium 6.2)
- [CVE-2026-42626](https://insights.sbomify.com/CVE-2026-42626/): HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing). (medium 5.9)
- [CVE-2026-4262](https://insights.sbomify.com/CVE-2026-4262/): Incorrect authorization in HiJiffy Chatbot (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/648/