Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 675 of 1013.
- CVE-2026-39737 WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39736 WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability
- CVE-2026-39735 WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability
- CVE-2026-39731 WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39730 WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability
- CVE-2026-3973 Tenda W3 POST Parameter setAutoPing formSetAutoPing stack-based overflow
- CVE-2026-39729 WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability
- CVE-2026-39728 WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-39727 WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39726 WordPress Lumise Product Designer plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39724 WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39723 WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability
- CVE-2026-39722 WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-39721 WordPress Starter Templates plugin <= 4.7.7 - Broken Access Control vulnerability
- CVE-2026-39720 WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3972 Tenda W3 HTTP setcfm formSetCfm stack-based overflow
- CVE-2026-39719 WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-39718 WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-39717 WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
- CVE-2026-39716 WordPress Flipmart theme <= 2.8 - Broken Access Control vulnerability
- CVE-2026-39715 WordPress AnyTrack Affiliate Link Manager plugin <= 1.5.5 - Broken Access Control vulnerability
- CVE-2026-39714 WordPress G5Plus April theme <= 6.8 - Broken Access Control vulnerability
- CVE-2026-39713 Missing authorization in Mailercloud – Integrate webforms and synchronize website contacts
- CVE-2026-39712 WordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-39711 WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Sensitive Data Exposure vulnerability
- CVE-2026-39710 WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-3971 Tenda i3 wifiSSIDset formwrlSSIDset stack-based overflow
- CVE-2026-39709 WordPress The Tribal plugin <= 1.3.4 - Sensitive Data Exposure vulnerability
- CVE-2026-39708 WordPress UiCore Elements plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39707 WordPress Accept PayPal Payments using Contact Form 7 plugin <= 4.0.4 - Broken Access Control vulnerability
- CVE-2026-39706 WordPress Make My Trivia plugin <= 1.1.0 - Broken Access Control vulnerability
- CVE-2026-39705 WordPress MIPL WC Multisite Sync plugin <= 1.4.4 - Broken Access Control vulnerability
- CVE-2026-39704 WordPress Precious Metals Automated Product Pricing – Pro plugin <= 4.0.5 - Broken Access Control vulnerability
- CVE-2026-39703 WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39702 WordPress Animation Addons for Elementor plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39701 WordPress ShopWP plugin <= 5.2.4 - Broken Access Control vulnerability
- CVE-2026-39700 WordPress WowOptin plugin <= 1.4.32 - Broken Access Control vulnerability
- CVE-2026-3970 Tenda i3 wifiSSIDget formwrlSSIDget stack-based overflow
- CVE-2026-39699 WordPress AI Workflow Automation plugin <= 1.4.2 - Broken Access Control vulnerability
- CVE-2026-39698 WordPress The Publisher Desk ads.txt plugin <= 1.5.0 - Broken Access Control vulnerability
- CVE-2026-39697 WordPress MAIO – The new AI GEO / SEO tool plugin <= 6.2.8 - Broken Access Control vulnerability
- CVE-2026-39696 WordPress Elfsight WhatsApp Chat CC plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39695 WordPress Podigee plugin <= 1.4.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-39694 WordPress Simply Schedule Appointments plugin <= 1.6.10.2 - Broken Access Control vulnerability
- CVE-2026-39693 WordPress FSM Custom Featured Image Caption plugin <= 1.25.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39692 WordPress tagDiv Composer plugin <= 5.4.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39691 Missing authorization in Cryptocurrency Donation Box – Bitcoin & Crypto Donations
- CVE-2026-39690 WordPress Author Avatars List/Block plugin <= 2.1.25 - Broken Access Control vulnerability
- CVE-2026-3969 FeMiner wms Basic Organizational Structure depart_add_bg.php sql injection
- CVE-2026-39689 WordPress eShipper Commerce plugin <= 2.16.12 - Broken Access Control vulnerability
- CVE-2026-39688 WordPress WP Frontend Profile plugin <= 1.3.9 - Broken Access Control vulnerability
- CVE-2026-39687 WordPress Rapid Car Check Vehicle Data plugin <= 2.0 - Broken Access Control vulnerability
- CVE-2026-39686 WordPress BSK PDF Manager plugin <= 3.7.2 - Sensitive Data Exposure vulnerability
- CVE-2026-39685 WordPress The Moneytizer plugin <= 10.0.10 - Broken Access Control vulnerability
- CVE-2026-39684 WordPress OrganicFood theme <= 3.6.4 - Local File Inclusion vulnerability
- CVE-2026-39683 WordPress Garden Gnome Package plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39682 WordPress linkPizza-Manager plugin <= 5.5.5 - Broken Access Control vulnerability
- CVE-2026-39681 WordPress Homeo theme <= 1.2.59 - Local File Inclusion vulnerability
- CVE-2026-39680 WordPress Diet Calorie Calculator plugin <= 1.1.1 - Broken Access Control vulnerability
- CVE-2026-3968 AutohomeCorp frostmourne Oracle Nashorn JavaScript ExpressionRule.java scriptEngine.eval code injection
- CVE-2026-39679 WordPress Freeio theme <= 1.3.21 - Local File Inclusion vulnerability
- CVE-2026-39678 WordPress Pinpoint Booking System plugin <= 2.9.9.7.2 - Broken Access Control vulnerability
- CVE-2026-39677 WordPress Emphires theme <= 3.9 - Local File Inclusion vulnerability
- CVE-2026-39676 WordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerability
- CVE-2026-39675 WordPress Court Reservation plugin <= 1.10.11 - Broken Access Control vulnerability
- CVE-2026-39674 WordPress MK Google Directions plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39673 WordPress iZooto plugin <= 3.7.20 - Broken Access Control vulnerability
- CVE-2026-39672 WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Broken Access Control vulnerability
- CVE-2026-39671 WordPress Extra Fees Plugin for WooCommerce plugin <= 4.3.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-39670 WordPress Visual Link Preview plugin <= 2.3.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-3967 Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization
- CVE-2026-39669 WordPress NitroPack plugin <= 1.19.3 - Broken Access Control vulnerability
- CVE-2026-39668 WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability
- CVE-2026-39667 WordPress Korea SNS plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39666 WordPress Hello Bar Popup Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39665 WordPress SEO Friendly Images plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39664 WordPress Leadrebel plugin <= 1.0.2 - Broken Access Control vulnerability
- CVE-2026-39663 WordPress TrueBooker plugin <= 1.1.5 - Broken Access Control vulnerability
- CVE-2026-39662 WordPress Product Price by Formula for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability
- CVE-2026-39661 WordPress SW Core plugin <= 1.7.18 - Local File Inclusion vulnerability
- CVE-2026-3966 648540858 wvp-GB28181-pro IP Address ABLMediaNodeServerService.java getDownloadFilePath server-side request forgery
- CVE-2026-39658 WordPress Panda Pods Repeater Field plugin <= 1.5.12 - Broken Access Control vulnerability
- CVE-2026-39657 WordPress leadlovers forms plugin <= 1.0.2 - Broken Access Control vulnerability
- CVE-2026-39656 WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability
- CVE-2026-39655 WordPress Mayosis Core plugin <= 5.4.7 - Broken Access Control vulnerability
- CVE-2026-39654 WordPress WP Simple HTML Sitemap plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39653 WordPress Video Conferencing with Zoom plugin <= 4.6.6 - Broken Access Control vulnerability
- CVE-2026-39652 WordPress iGMS Direct Booking plugin <= 1.3 - Broken Access Control vulnerability
- CVE-2026-39651 WordPress Total Poll Lite plugin <= 4.12.0 - Broken Access Control vulnerability
- CVE-2026-39650 WordPress UnitechPay plugin <= 1.0.2 - Broken Access Control vulnerability
- CVE-2026-3965 whyour qinglong API express.ts protection mechanism
- CVE-2026-39649 WordPress Royale News theme <= 2.2.4 - Broken Access Control vulnerability
- CVE-2026-39648 WordPress Cream Blog theme <= 2.1.7 - Broken Access Control vulnerability
- CVE-2026-39647 Server-side request forgery in MP3 Audio Player for Music, Radio & Podcast by Sonaar
- CVE-2026-39646 WordPress Leaflet Map plugin <= 3.4.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-39645 WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-39644 WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerability
- CVE-2026-39643 WordPress Payment Plugins for PayPal WooCommerce plugin <= 2.0.13 - Broken Access Control vulnerability
- CVE-2026-39642 WordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-39641 WordPress Blackfyre theme <= 2.5.4 - Cross Site Request Forgery (CSRF) vulnerability