# Vulnerabilities published in 2026


- [CVE-2026-39640](https://insights.sbomify.com/CVE-2026-39640/): WordPress Theme Editor plugin <= 3.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution vulnerability (critical 9.6)
- [CVE-2026-3964](https://insights.sbomify.com/CVE-2026-3964/): OpenAkita Chat API Endpoint shell.py run os command injection (medium 4.8)
- [CVE-2026-39639](https://insights.sbomify.com/CVE-2026-39639/): WordPress RPS Include Content plugin <= 1.2.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39638](https://insights.sbomify.com/CVE-2026-39638/): WordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-39637](https://insights.sbomify.com/CVE-2026-39637/): WordPress Mogi theme <= 1.2.3 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-39636](https://insights.sbomify.com/CVE-2026-39636/): WordPress Livemesh Addons for Elementor plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39635](https://insights.sbomify.com/CVE-2026-39635/): WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-39634](https://insights.sbomify.com/CVE-2026-39634/): WordPress Grand Portfolio theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-39633](https://insights.sbomify.com/CVE-2026-39633/): WordPress Grand Car Rental theme <= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2026-39632](https://insights.sbomify.com/CVE-2026-39632/): WordPress Grand Blog theme <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2026-39631](https://insights.sbomify.com/CVE-2026-39631/): WordPress WPSchoolPress plugin <= 2.2.35 - Broken Access Control vulnerability (medium 4.9)
- [CVE-2026-39630](https://insights.sbomify.com/CVE-2026-39630/): WordPress Getty Images plugin <= 4.1.0 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2026-3963](https://insights.sbomify.com/CVE-2026-3963/): perfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded key (medium 6.3)
- [CVE-2026-39629](https://insights.sbomify.com/CVE-2026-39629/): WordPress Uminex theme <= 1.0.9 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-39628](https://insights.sbomify.com/CVE-2026-39628/): WordPress DukaMarket theme <= 1.3.0 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-39627](https://insights.sbomify.com/CVE-2026-39627/): WordPress Ashe theme <= 2.266 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39626](https://insights.sbomify.com/CVE-2026-39626/): WordPress Armania theme <= 1.4.8 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-39625](https://insights.sbomify.com/CVE-2026-39625/): WordPress TechOne theme <= 3.0.3 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-39624](https://insights.sbomify.com/CVE-2026-39624/): WordPress Biolife theme <= 3.2.3 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-39623](https://insights.sbomify.com/CVE-2026-39623/): WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-39622](https://insights.sbomify.com/CVE-2026-39622/): WordPress Education Base theme <= 3.0.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39621](https://insights.sbomify.com/CVE-2026-39621/): WordPress SpicePress theme <= 2.3.2.5 - CSRF to Arbitrary Plugin Installation vulnerability (high 8.8)
- [CVE-2026-39620](https://insights.sbomify.com/CVE-2026-39620/): WordPress Appointment theme <= 3.5.5 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability (critical 9.6)
- [CVE-2026-3962](https://insights.sbomify.com/CVE-2026-3962/): Jcharis Machine-Learning-Web-Apps Jinja2 Template app.py render_template cross site scripting (medium 5.3)
- [CVE-2026-39619](https://insights.sbomify.com/CVE-2026-39619/): WordPress Busiprof theme <= 2.5.2 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability (critical 9.6)
- [CVE-2026-39618](https://insights.sbomify.com/CVE-2026-39618/): WordPress NewsExo theme <= 7.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-39617](https://insights.sbomify.com/CVE-2026-39617/): WordPress Bluestreet theme <= 1.7.3 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Installation vulnerability (critical 9.6)
- [CVE-2026-39616](https://insights.sbomify.com/CVE-2026-39616/): WordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-39615](https://insights.sbomify.com/CVE-2026-39615/): WordPress Download Manager plugin <= 3.3.53 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-39614](https://insights.sbomify.com/CVE-2026-39614/): WordPress JW Player for WordPress plugin <= 2.3.6 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-39613](https://insights.sbomify.com/CVE-2026-39613/): WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-39612](https://insights.sbomify.com/CVE-2026-39612/): WordPress KuteShop theme <= 4.2.9 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-39611](https://insights.sbomify.com/CVE-2026-39611/): WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-39610](https://insights.sbomify.com/CVE-2026-39610/): WordPress WpXmas-Snow plugin <= 1.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3961](https://insights.sbomify.com/CVE-2026-3961/): zyddnys manga-image-translator Translate Endpoints request_extraction.py to_pil_image server-side request forgery (medium 5.3)
- [CVE-2026-39609](https://insights.sbomify.com/CVE-2026-39609/): WordPress Wava Payment plugin <= 0.3.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39608](https://insights.sbomify.com/CVE-2026-39608/): WordPress iPOSpays Gateways WC plugin <= 1.3.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39607](https://insights.sbomify.com/CVE-2026-39607/): WordPress Filter Plus plugin <= 1.1.17 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-39606](https://insights.sbomify.com/CVE-2026-39606/): WordPress BizReview plugin <= 1.5.13 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39605](https://insights.sbomify.com/CVE-2026-39605/): WordPress Super Custom Login plugin <= 1.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39604](https://insights.sbomify.com/CVE-2026-39604/): WordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-39603](https://insights.sbomify.com/CVE-2026-39603/): WordPress Grand Photography theme <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-39602](https://insights.sbomify.com/CVE-2026-39602/): WordPress Order Tracking plugin <= 3.4.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39601](https://insights.sbomify.com/CVE-2026-39601/): WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability (low 3.7)
- [CVE-2026-39600](https://insights.sbomify.com/CVE-2026-39600/): WordPress Aculect AI Companion plugin <= 0.8.2 - Unvalidated Redirects and Forwards vulnerability (medium 4.7)
- [CVE-2026-3960](https://insights.sbomify.com/CVE-2026-3960/): Remote Code Execution in h2oai/h2o-3 (medium 5.9)
- [CVE-2026-39599](https://insights.sbomify.com/CVE-2026-39599/): WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39598](https://insights.sbomify.com/CVE-2026-39598/): WordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerability (high 8.0)
- [CVE-2026-39597](https://insights.sbomify.com/CVE-2026-39597/): WordPress WPZOOM Addons for Elementor plugin <= 1.3.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39596](https://insights.sbomify.com/CVE-2026-39596/): WordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39595](https://insights.sbomify.com/CVE-2026-39595/): WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability (medium 4.7)
- [CVE-2026-39594](https://insights.sbomify.com/CVE-2026-39594/): WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability (medium 6.4)
- [CVE-2026-39593](https://insights.sbomify.com/CVE-2026-39593/): WordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39592](https://insights.sbomify.com/CVE-2026-39592/): WordPress DEPART plugin <= 1.0.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39591](https://insights.sbomify.com/CVE-2026-39591/): WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-39590](https://insights.sbomify.com/CVE-2026-39590/): WordPress Atomlab theme <= 2.4.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-3959](https://insights.sbomify.com/CVE-2026-3959/): 0xKoda WireMCP Tshark CLI index.js server.tool os command injection (medium 4.8)
- [CVE-2026-39589](https://insights.sbomify.com/CVE-2026-39589/): WordPress Webenvo theme <= 0.0.6 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-39588](https://insights.sbomify.com/CVE-2026-39588/): WordPress NM Gift Registry and Wishlist Lite plugin <= 5.13 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39587](https://insights.sbomify.com/CVE-2026-39587/): WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability (high 8.1)
- [CVE-2026-39586](https://insights.sbomify.com/CVE-2026-39586/): WordPress RepairBuddy plugin <= 4.1132 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-39585](https://insights.sbomify.com/CVE-2026-39585/): WordPress Booktics plugin <= 1.0.16 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39584](https://insights.sbomify.com/CVE-2026-39584/): WordPress RepairBuddy plugin <= 4.1132 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39583](https://insights.sbomify.com/CVE-2026-39583/): WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-39582](https://insights.sbomify.com/CVE-2026-39582/): WordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-39581](https://insights.sbomify.com/CVE-2026-39581/): WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-39580](https://insights.sbomify.com/CVE-2026-39580/): WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-3958](https://insights.sbomify.com/CVE-2026-3958/): Woahai321 ListSync JSON api_server.py requests.post server-side request forgery (medium 5.3)
- [CVE-2026-39579](https://insights.sbomify.com/CVE-2026-39579/): WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-39578](https://insights.sbomify.com/CVE-2026-39578/): WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39577](https://insights.sbomify.com/CVE-2026-39577/): WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39576](https://insights.sbomify.com/CVE-2026-39576/): WordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39575](https://insights.sbomify.com/CVE-2026-39575/): WordPress Custom Query Blocks plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39574](https://insights.sbomify.com/CVE-2026-39574/): WordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39573](https://insights.sbomify.com/CVE-2026-39573/): WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39572](https://insights.sbomify.com/CVE-2026-39572/): WordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.5 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-39571](https://insights.sbomify.com/CVE-2026-39571/): WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-39570](https://insights.sbomify.com/CVE-2026-39570/): WordPress 12 Step Meeting List plugin <= 3.19.9 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-3957](https://insights.sbomify.com/CVE-2026-3957/): xierongwkhd weimai-wetapp Endpoint HomeController.java getLikeMovieList sql injection (medium 5.1)
- [CVE-2026-39569](https://insights.sbomify.com/CVE-2026-39569/): WordPress 12 Step Meeting List plugin <= 3.19.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39568](https://insights.sbomify.com/CVE-2026-39568/): WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-39567](https://insights.sbomify.com/CVE-2026-39567/): WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39566](https://insights.sbomify.com/CVE-2026-39566/): WordPress DirectoryPress plugin <= 3.6.26 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-39565](https://insights.sbomify.com/CVE-2026-39565/): WordPress WpTravelly plugin <= 2.1.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39564](https://insights.sbomify.com/CVE-2026-39564/): WordPress Sunshine Photo Cart plugin < 3.6.2 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-39563](https://insights.sbomify.com/CVE-2026-39563/): WordPress Share This Image plugin <= 2.12 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39562](https://insights.sbomify.com/CVE-2026-39562/): WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39561](https://insights.sbomify.com/CVE-2026-39561/): WordPress Revive.so plugin <= 2.0.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39560](https://insights.sbomify.com/CVE-2026-39560/): WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-3956](https://insights.sbomify.com/CVE-2026-3956/): xierongwkhd weimai-wetapp Admin_AdminUserController.java getAdmins sql injection (medium 5.1)
- [CVE-2026-39559](https://insights.sbomify.com/CVE-2026-39559/): WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-39558](https://insights.sbomify.com/CVE-2026-39558/): WordPress Malmö theme <= 2.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-39557](https://insights.sbomify.com/CVE-2026-39557/): WordPress NeoBeat theme <= 1.7 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39556](https://insights.sbomify.com/CVE-2026-39556/): WordPress Konsept theme <= 1.9 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39555](https://insights.sbomify.com/CVE-2026-39555/): WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39554](https://insights.sbomify.com/CVE-2026-39554/): WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39553](https://insights.sbomify.com/CVE-2026-39553/): WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-39552](https://insights.sbomify.com/CVE-2026-39552/): WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-39551](https://insights.sbomify.com/CVE-2026-39551/): WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39550](https://insights.sbomify.com/CVE-2026-39550/): WordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/676/