# Vulnerabilities published in 2026


- [CVE-2026-39737](https://insights.sbomify.com/CVE-2026-39737/): WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39736](https://insights.sbomify.com/CVE-2026-39736/): WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-39735](https://insights.sbomify.com/CVE-2026-39735/): WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39731](https://insights.sbomify.com/CVE-2026-39731/): WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39730](https://insights.sbomify.com/CVE-2026-39730/): WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-3973](https://insights.sbomify.com/CVE-2026-3973/): Tenda W3 POST Parameter setAutoPing formSetAutoPing stack-based overflow (high 8.7)
- [CVE-2026-39729](https://insights.sbomify.com/CVE-2026-39729/): WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability (high 7.2)
- [CVE-2026-39728](https://insights.sbomify.com/CVE-2026-39728/): WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-39727](https://insights.sbomify.com/CVE-2026-39727/): WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39726](https://insights.sbomify.com/CVE-2026-39726/): WordPress Lumise Product Designer plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39724](https://insights.sbomify.com/CVE-2026-39724/): WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39723](https://insights.sbomify.com/CVE-2026-39723/): WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-39722](https://insights.sbomify.com/CVE-2026-39722/): WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39721](https://insights.sbomify.com/CVE-2026-39721/): WordPress Starter Templates plugin <= 4.7.7 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-39720](https://insights.sbomify.com/CVE-2026-39720/): WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-3972](https://insights.sbomify.com/CVE-2026-3972/): Tenda W3 HTTP setcfm formSetCfm stack-based overflow (high 8.7)
- [CVE-2026-39719](https://insights.sbomify.com/CVE-2026-39719/): WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-39718](https://insights.sbomify.com/CVE-2026-39718/): WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-39717](https://insights.sbomify.com/CVE-2026-39717/): WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39716](https://insights.sbomify.com/CVE-2026-39716/): WordPress Flipmart theme <= 2.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39715](https://insights.sbomify.com/CVE-2026-39715/): WordPress AnyTrack Affiliate Link Manager plugin <= 1.5.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39714](https://insights.sbomify.com/CVE-2026-39714/): WordPress G5Plus April theme <= 6.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39713](https://insights.sbomify.com/CVE-2026-39713/): Missing authorization in Mailercloud – Integrate webforms and synchronize website contacts (medium 5.3)
- [CVE-2026-39712](https://insights.sbomify.com/CVE-2026-39712/): WordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-39711](https://insights.sbomify.com/CVE-2026-39711/): WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-39710](https://insights.sbomify.com/CVE-2026-39710/): WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-3971](https://insights.sbomify.com/CVE-2026-3971/): Tenda i3 wifiSSIDset formwrlSSIDset stack-based overflow (high 8.7)
- [CVE-2026-39709](https://insights.sbomify.com/CVE-2026-39709/): WordPress The Tribal plugin <= 1.3.4 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-39708](https://insights.sbomify.com/CVE-2026-39708/): WordPress UiCore Elements plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39707](https://insights.sbomify.com/CVE-2026-39707/): WordPress Accept PayPal Payments using Contact Form 7 plugin <= 4.0.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39706](https://insights.sbomify.com/CVE-2026-39706/): WordPress Make My Trivia plugin <= 1.1.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39705](https://insights.sbomify.com/CVE-2026-39705/): WordPress MIPL WC Multisite Sync plugin <= 1.4.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39704](https://insights.sbomify.com/CVE-2026-39704/): WordPress Precious Metals Automated Product Pricing – Pro plugin <= 4.0.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39703](https://insights.sbomify.com/CVE-2026-39703/): WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39702](https://insights.sbomify.com/CVE-2026-39702/): WordPress Animation Addons for Elementor plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39701](https://insights.sbomify.com/CVE-2026-39701/): WordPress ShopWP plugin <= 5.2.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39700](https://insights.sbomify.com/CVE-2026-39700/): WordPress WowOptin plugin <= 1.4.32 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3970](https://insights.sbomify.com/CVE-2026-3970/): Tenda i3 wifiSSIDget formwrlSSIDget stack-based overflow (high 8.7)
- [CVE-2026-39699](https://insights.sbomify.com/CVE-2026-39699/): WordPress AI Workflow Automation plugin <= 1.4.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39698](https://insights.sbomify.com/CVE-2026-39698/): WordPress The Publisher Desk ads.txt plugin <= 1.5.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39697](https://insights.sbomify.com/CVE-2026-39697/): WordPress MAIO – The new AI GEO / SEO tool plugin <= 6.2.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39696](https://insights.sbomify.com/CVE-2026-39696/): WordPress Elfsight WhatsApp Chat CC plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39695](https://insights.sbomify.com/CVE-2026-39695/): WordPress Podigee plugin <= 1.4.0 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2026-39694](https://insights.sbomify.com/CVE-2026-39694/): WordPress Simply Schedule Appointments plugin <= 1.6.10.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39693](https://insights.sbomify.com/CVE-2026-39693/): WordPress FSM Custom Featured Image Caption plugin <= 1.25.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-39692](https://insights.sbomify.com/CVE-2026-39692/): WordPress tagDiv Composer plugin <= 5.4.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39691](https://insights.sbomify.com/CVE-2026-39691/): Missing authorization in Cryptocurrency Donation Box – Bitcoin & Crypto Donations (medium 5.3)
- [CVE-2026-39690](https://insights.sbomify.com/CVE-2026-39690/): WordPress Author Avatars List/Block plugin <= 2.1.25 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3969](https://insights.sbomify.com/CVE-2026-3969/): FeMiner wms Basic Organizational Structure depart_add_bg.php sql injection (medium 6.9)
- [CVE-2026-39689](https://insights.sbomify.com/CVE-2026-39689/): WordPress eShipper Commerce plugin <= 2.16.12 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39688](https://insights.sbomify.com/CVE-2026-39688/): WordPress WP Frontend Profile plugin <= 1.3.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39687](https://insights.sbomify.com/CVE-2026-39687/): WordPress Rapid Car Check Vehicle Data plugin <= 2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39686](https://insights.sbomify.com/CVE-2026-39686/): WordPress BSK PDF Manager plugin <= 3.7.2 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-39685](https://insights.sbomify.com/CVE-2026-39685/): WordPress The Moneytizer plugin <= 10.0.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39684](https://insights.sbomify.com/CVE-2026-39684/): WordPress OrganicFood theme <= 3.6.4 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-39683](https://insights.sbomify.com/CVE-2026-39683/): WordPress Garden Gnome Package plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-39682](https://insights.sbomify.com/CVE-2026-39682/): WordPress linkPizza-Manager plugin <= 5.5.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39681](https://insights.sbomify.com/CVE-2026-39681/): WordPress Homeo theme <= 1.2.59 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-39680](https://insights.sbomify.com/CVE-2026-39680/): WordPress Diet Calorie Calculator plugin <= 1.1.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3968](https://insights.sbomify.com/CVE-2026-3968/): AutohomeCorp frostmourne Oracle Nashorn JavaScript ExpressionRule.java scriptEngine.eval code injection (medium 5.3)
- [CVE-2026-39679](https://insights.sbomify.com/CVE-2026-39679/): WordPress Freeio theme <= 1.3.21 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-39678](https://insights.sbomify.com/CVE-2026-39678/): WordPress Pinpoint Booking System plugin <= 2.9.9.7.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39677](https://insights.sbomify.com/CVE-2026-39677/): WordPress Emphires theme <= 3.9 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-39676](https://insights.sbomify.com/CVE-2026-39676/): WordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39675](https://insights.sbomify.com/CVE-2026-39675/): WordPress Court Reservation plugin <= 1.10.11 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39674](https://insights.sbomify.com/CVE-2026-39674/): WordPress MK Google Directions plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39673](https://insights.sbomify.com/CVE-2026-39673/): WordPress iZooto plugin <= 3.7.20 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39672](https://insights.sbomify.com/CVE-2026-39672/): WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39671](https://insights.sbomify.com/CVE-2026-39671/): WordPress Extra Fees Plugin for WooCommerce plugin <= 4.3.3 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2026-39670](https://insights.sbomify.com/CVE-2026-39670/): WordPress Visual Link Preview plugin <= 2.3.0 - Server Side Request Forgery (SSRF) vulnerability (medium 6.0)
- [CVE-2026-3967](https://insights.sbomify.com/CVE-2026-3967/): Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization (medium 5.3)
- [CVE-2026-39669](https://insights.sbomify.com/CVE-2026-39669/): WordPress NitroPack plugin <= 1.19.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39668](https://insights.sbomify.com/CVE-2026-39668/): WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39667](https://insights.sbomify.com/CVE-2026-39667/): WordPress Korea SNS plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-39666](https://insights.sbomify.com/CVE-2026-39666/): WordPress Hello Bar Popup Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39665](https://insights.sbomify.com/CVE-2026-39665/): WordPress SEO Friendly Images plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39664](https://insights.sbomify.com/CVE-2026-39664/): WordPress Leadrebel plugin <= 1.0.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39663](https://insights.sbomify.com/CVE-2026-39663/): WordPress TrueBooker plugin <= 1.1.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39662](https://insights.sbomify.com/CVE-2026-39662/): WordPress Product Price by Formula for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39661](https://insights.sbomify.com/CVE-2026-39661/): WordPress SW Core plugin <= 1.7.18 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-3966](https://insights.sbomify.com/CVE-2026-3966/): 648540858 wvp-GB28181-pro IP Address ABLMediaNodeServerService.java getDownloadFilePath server-side request forgery (medium 5.3)
- [CVE-2026-39658](https://insights.sbomify.com/CVE-2026-39658/): WordPress Panda Pods Repeater Field plugin <= 1.5.12 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39657](https://insights.sbomify.com/CVE-2026-39657/): WordPress leadlovers forms plugin <= 1.0.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39656](https://insights.sbomify.com/CVE-2026-39656/): WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39655](https://insights.sbomify.com/CVE-2026-39655/): WordPress Mayosis Core plugin <= 5.4.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39654](https://insights.sbomify.com/CVE-2026-39654/): WordPress WP Simple HTML Sitemap plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-39653](https://insights.sbomify.com/CVE-2026-39653/): WordPress Video Conferencing with Zoom plugin <= 4.6.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39652](https://insights.sbomify.com/CVE-2026-39652/): WordPress iGMS Direct Booking plugin <= 1.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39651](https://insights.sbomify.com/CVE-2026-39651/): WordPress Total Poll Lite plugin <= 4.12.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39650](https://insights.sbomify.com/CVE-2026-39650/): WordPress UnitechPay plugin <= 1.0.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3965](https://insights.sbomify.com/CVE-2026-3965/): whyour qinglong API express.ts protection mechanism (medium 5.3)
- [CVE-2026-39649](https://insights.sbomify.com/CVE-2026-39649/): WordPress Royale News theme <= 2.2.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39648](https://insights.sbomify.com/CVE-2026-39648/): WordPress Cream Blog theme <= 2.1.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39647](https://insights.sbomify.com/CVE-2026-39647/): Server-side request forgery in MP3 Audio Player for Music, Radio & Podcast by Sonaar (medium 5.4)
- [CVE-2026-39646](https://insights.sbomify.com/CVE-2026-39646/): WordPress Leaflet Map plugin <= 3.4.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39645](https://insights.sbomify.com/CVE-2026-39645/): WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2026-39644](https://insights.sbomify.com/CVE-2026-39644/): WordPress Wp Ultimate Review plugin <= 2.3.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39643](https://insights.sbomify.com/CVE-2026-39643/): WordPress Payment Plugins for PayPal WooCommerce plugin <= 2.0.13 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39642](https://insights.sbomify.com/CVE-2026-39642/): WordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-39641](https://insights.sbomify.com/CVE-2026-39641/): WordPress Blackfyre theme <= 2.5.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/675/