# Vulnerabilities published in 2026


- [CVE-2026-4085](https://insights.sbomify.com/CVE-2026-4085/): Cross-site scripting in Easy Social Photos Gallery – MIF (medium 6.4)
- [CVE-2026-40849](https://insights.sbomify.com/CVE-2026-40849/): Authenticated SQLi in user_alarmprofile view (high 7.1)
- [CVE-2026-40848](https://insights.sbomify.com/CVE-2026-40848/): Authenticated SQLi in tag view (high 7.1)
- [CVE-2026-40847](https://insights.sbomify.com/CVE-2026-40847/): Authenticated SQLi in system_tag view (high 7.1)
- [CVE-2026-40846](https://insights.sbomify.com/CVE-2026-40846/): Authenticated SQLi in system view (high 7.1)
- [CVE-2026-40845](https://insights.sbomify.com/CVE-2026-40845/): Authenticated SQLi in devices_configuration view (high 7.1)
- [CVE-2026-40844](https://insights.sbomify.com/CVE-2026-40844/): Authenticated SQLi in dashboard view (high 7.1)
- [CVE-2026-40843](https://insights.sbomify.com/CVE-2026-40843/): Authenticated SQLi in alarming view (high 7.1)
- [CVE-2026-40842](https://insights.sbomify.com/CVE-2026-40842/): Authenticated SQLi in getWidgetTags function (high 7.1)
- [CVE-2026-40841](https://insights.sbomify.com/CVE-2026-40841/): Authenticated SQLi in getProjectTags function (high 7.1)
- [CVE-2026-40840](https://insights.sbomify.com/CVE-2026-40840/): Authenticated SQLi in VerifyCreateLicences function (high 7.1)
- [CVE-2026-4084](https://insights.sbomify.com/CVE-2026-4084/): Cross-site scripting in fyyd podcast shortcodes (medium 6.4)
- [CVE-2026-40839](https://insights.sbomify.com/CVE-2026-40839/): Authenticated SQLi in getComponentScalings function (high 7.1)
- [CVE-2026-40838](https://insights.sbomify.com/CVE-2026-40838/): Authenticated SQLi in getDeviceScalings function (high 7.1)
- [CVE-2026-40837](https://insights.sbomify.com/CVE-2026-40837/): Authenticated SQLi in getProjectScalings function (high 7.1)
- [CVE-2026-40836](https://insights.sbomify.com/CVE-2026-40836/): Authenticated SQLi in inmessage model (high 7.1)
- [CVE-2026-40835](https://insights.sbomify.com/CVE-2026-40835/): Authenticated SQLi in saveObjectFromData function (high 7.1)
- [CVE-2026-40834](https://insights.sbomify.com/CVE-2026-40834/): Authenticated SQLi in saveDashboardLayout function (high 7.1)
- [CVE-2026-40833](https://insights.sbomify.com/CVE-2026-40833/): Authenticated SQLi in saveDashboardLayout function (high 7.1)
- [CVE-2026-40832](https://insights.sbomify.com/CVE-2026-40832/): Authenticated SQLi in getDevicegroups function (high 7.1)
- [CVE-2026-40831](https://insights.sbomify.com/CVE-2026-40831/): Authenticated SQLi in Easy View (high 7.1)
- [CVE-2026-40830](https://insights.sbomify.com/CVE-2026-40830/): Authenticated SQLi in UpdateParam function (high 7.0)
- [CVE-2026-4083](https://insights.sbomify.com/CVE-2026-4083/): Cross-site scripting in Scoreboard for HTML5 Games Lite (medium 6.4)
- [CVE-2026-40829](https://insights.sbomify.com/CVE-2026-40829/): Authenticated SQLi in UpdateParam function (high 7.0)
- [CVE-2026-40828](https://insights.sbomify.com/CVE-2026-40828/): Authenticated SQLi in DeleteSysLogEntry function (high 7.0)
- [CVE-2026-40827](https://insights.sbomify.com/CVE-2026-40827/): Authenticated SQLi in _RemoveRequest function (high 7.0)
- [CVE-2026-40826](https://insights.sbomify.com/CVE-2026-40826/): Authenticated SQLi in dsgvo_contracts view (medium 6.9)
- [CVE-2026-40825](https://insights.sbomify.com/CVE-2026-40825/): Authenticated SQLi in accountstatus view (high 7.0)
- [CVE-2026-40824](https://insights.sbomify.com/CVE-2026-40824/): Authenticated SQLi in accountstatus view (high 7.0)
- [CVE-2026-40823](https://insights.sbomify.com/CVE-2026-40823/): Authenticated SQLi in DevSerialReset function (high 7.0)
- [CVE-2026-40822](https://insights.sbomify.com/CVE-2026-40822/): Authenticated SQLi in DevSerialReset function (medium 6.9)
- [CVE-2026-40821](https://insights.sbomify.com/CVE-2026-40821/): Authenticated SQLi in getAccountByID function (medium 6.9)
- [CVE-2026-4082](https://insights.sbomify.com/CVE-2026-4082/): ER Swiffy Insert <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-40819](https://insights.sbomify.com/CVE-2026-40819/): Unauthenticated SQLi in sync_data24 task (high 8.7)
- [CVE-2026-40818](https://insights.sbomify.com/CVE-2026-40818/): Unauthenticated SQLi in _mb24confi_getDevice function function (high 8.7)
- [CVE-2026-40817](https://insights.sbomify.com/CVE-2026-40817/): Unauthenticated SQLi in getAlarmProfiles function (high 8.7)
- [CVE-2026-40816](https://insights.sbomify.com/CVE-2026-40816/): Unauthenticated SQLi in _mb24confi_getTagAlarm function (high 8.7)
- [CVE-2026-40815](https://insights.sbomify.com/CVE-2026-40815/): Unauthenticated SQLi in _mb24api_getUserAccount function (high 8.7)
- [CVE-2026-40814](https://insights.sbomify.com/CVE-2026-40814/): Unauthenticated SQLi in _mb24confi_getTagAlarm function (high 8.7)
- [CVE-2026-40813](https://insights.sbomify.com/CVE-2026-40813/): Unauthenticated SQLi in getLiveValues (high 8.7)
- [CVE-2026-40812](https://insights.sbomify.com/CVE-2026-40812/): Unauthenticated SQLi in getLiveValues function (high 8.7)
- [CVE-2026-40811](https://insights.sbomify.com/CVE-2026-40811/): Unauthenticated SQLi in ssoabstractservice (high 8.7)
- [CVE-2026-40810](https://insights.sbomify.com/CVE-2026-40810/): Unauthenticated SQLi in userinfo Endpoint (high 8.7)
- [CVE-2026-4081](https://insights.sbomify.com/CVE-2026-4081/): ZeM STL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-40809](https://insights.sbomify.com/CVE-2026-40809/): WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-40808](https://insights.sbomify.com/CVE-2026-40808/): WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-40807](https://insights.sbomify.com/CVE-2026-40807/): Cross-site scripting in CF7 Views &#8211; Complete Entry Management for Contact Form 7 (high 7.1)
- [CVE-2026-40806](https://insights.sbomify.com/CVE-2026-40806/): WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-40805](https://insights.sbomify.com/CVE-2026-40805/): WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2026-40804](https://insights.sbomify.com/CVE-2026-40804/): WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-40803](https://insights.sbomify.com/CVE-2026-40803/): WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-40802](https://insights.sbomify.com/CVE-2026-40802/): WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability (high 7.6)
- [CVE-2026-40801](https://insights.sbomify.com/CVE-2026-40801/): WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability (high 8.1)
- [CVE-2026-40800](https://insights.sbomify.com/CVE-2026-40800/): SQL injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes (critical 9.3)
- [CVE-2026-4080](https://insights.sbomify.com/CVE-2026-4080/): Easy Cart <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-40799](https://insights.sbomify.com/CVE-2026-40799/): WordPress Simple Cloudflare Turnstile plugin <= 1.38.0 - Broken Authentication vulnerability (medium 5.8)
- [CVE-2026-40798](https://insights.sbomify.com/CVE-2026-40798/): WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-40797](https://insights.sbomify.com/CVE-2026-40797/): WordPress WebinarIgnition plugin <= 4.08.253 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-40796](https://insights.sbomify.com/CVE-2026-40796/): WordPress WPPizza plugin <= 3.19.9 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-40795](https://insights.sbomify.com/CVE-2026-40795/): WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-40794](https://insights.sbomify.com/CVE-2026-40794/): WordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-40793](https://insights.sbomify.com/CVE-2026-40793/): WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-40792](https://insights.sbomify.com/CVE-2026-40792/): WordPress KiviCare plugin <= 4.2.1 - Insecure Direct Object References (IDOR) vulnerability (medium 6.3)
- [CVE-2026-40791](https://insights.sbomify.com/CVE-2026-40791/): WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-40790](https://insights.sbomify.com/CVE-2026-40790/): WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-4079](https://insights.sbomify.com/CVE-2026-4079/): SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection (medium 6.5)
- [CVE-2026-40789](https://insights.sbomify.com/CVE-2026-40789/): WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-40788](https://insights.sbomify.com/CVE-2026-40788/): WordPress ChatBot plugin <= 7.9.7 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-40787](https://insights.sbomify.com/CVE-2026-40787/): WordPress Quiz And Survey Master plugin <= 11.0.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-40786](https://insights.sbomify.com/CVE-2026-40786/): WordPress MyRewards plugin <= 5.7.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-40785](https://insights.sbomify.com/CVE-2026-40785/): WordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerability (high 7.1)
- [CVE-2026-40784](https://insights.sbomify.com/CVE-2026-40784/): WordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability (high 8.1)
- [CVE-2026-40783](https://insights.sbomify.com/CVE-2026-40783/): WordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-40782](https://insights.sbomify.com/CVE-2026-40782/): WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-40781](https://insights.sbomify.com/CVE-2026-40781/): WordPress ReviewX plugin <= 2.3.6 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-40780](https://insights.sbomify.com/CVE-2026-40780/): WordPress BookIt plugin < 2.5.4.1 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-4078](https://insights.sbomify.com/CVE-2026-4078/): ITERAS <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-40779](https://insights.sbomify.com/CVE-2026-40779/): WordPress Link Library plugin <= 7.8.8 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2026-40778](https://insights.sbomify.com/CVE-2026-40778/): WordPress Majestic Support plugin <= 1.1.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-40777](https://insights.sbomify.com/CVE-2026-40777/): WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability (high 8.1)
- [CVE-2026-40776](https://insights.sbomify.com/CVE-2026-40776/): WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-40775](https://insights.sbomify.com/CVE-2026-40775/): WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-40774](https://insights.sbomify.com/CVE-2026-40774/): WordPress Booking Package plugin <= 1.7.06 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-40773](https://insights.sbomify.com/CVE-2026-40773/): WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-40772](https://insights.sbomify.com/CVE-2026-40772/): WordPress GeekyBot plugin <= 1.2.2 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2026-40771](https://insights.sbomify.com/CVE-2026-40771/): WordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-40770](https://insights.sbomify.com/CVE-2026-40770/): WordPress Coupon Affiliates plugin <= 7.5.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-4077](https://insights.sbomify.com/CVE-2026-4077/): Cross-site scripting in Ecover Builder For Dummies (medium 6.4)
- [CVE-2026-40769](https://insights.sbomify.com/CVE-2026-40769/): Path traversal in Contact Form Extender for Divi &#8211; Save Entries, File Upload &amp; Country Code Field (high 8.6)
- [CVE-2026-40768](https://insights.sbomify.com/CVE-2026-40768/): WordPress Salon booking system plugin <= 10.30.24 - Insecure Direct Object References (IDOR) vulnerability (high 7.3)
- [CVE-2026-40767](https://insights.sbomify.com/CVE-2026-40767/): WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-40766](https://insights.sbomify.com/CVE-2026-40766/): WordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-40765](https://insights.sbomify.com/CVE-2026-40765/): WordPress collectchat plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-40764](https://insights.sbomify.com/CVE-2026-40764/): WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability (high 8.1)
- [CVE-2026-40763](https://insights.sbomify.com/CVE-2026-40763/): WordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-40762](https://insights.sbomify.com/CVE-2026-40762/): WordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerability (high 7.5)
- [CVE-2026-40761](https://insights.sbomify.com/CVE-2026-40761/): WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40760](https://insights.sbomify.com/CVE-2026-40760/): WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-4076](https://insights.sbomify.com/CVE-2026-4076/): Slider Bootstrap Carousel <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-40759](https://insights.sbomify.com/CVE-2026-40759/): WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/665/