# Vulnerabilities published in 2026


- [CVE-2026-3955](https://insights.sbomify.com/CVE-2026-3955/): elecV2P jsfile Endpoint wbjs.js runJSFile code injection (medium 5.3)
- [CVE-2026-39549](https://insights.sbomify.com/CVE-2026-39549/): WordPress Aperitif theme <= 1.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-39548](https://insights.sbomify.com/CVE-2026-39548/): WordPress MagOne theme <= 9.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39547](https://insights.sbomify.com/CVE-2026-39547/): WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-39546](https://insights.sbomify.com/CVE-2026-39546/): WordPress MultiLoca plugin <= 4.2.15 - Privilege Escalation vulnerability (high 7.6)
- [CVE-2026-39545](https://insights.sbomify.com/CVE-2026-39545/): WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39544](https://insights.sbomify.com/CVE-2026-39544/): WordPress LabtechCO theme <= 8.3 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-39543](https://insights.sbomify.com/CVE-2026-39543/): WordPress Tourfic plugin <= 2.21.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39542](https://insights.sbomify.com/CVE-2026-39542/): WordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-39541](https://insights.sbomify.com/CVE-2026-39541/): WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-39540](https://insights.sbomify.com/CVE-2026-39540/): WordPress Shipment Tracker for Woocommerce plugin <= 1.5.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-3954](https://insights.sbomify.com/CVE-2026-3954/): OpenBMB XAgent workspace.py workspace path traversal (medium 6.9)
- [CVE-2026-39539](https://insights.sbomify.com/CVE-2026-39539/): WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39538](https://insights.sbomify.com/CVE-2026-39538/): WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-39537](https://insights.sbomify.com/CVE-2026-39537/): WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-39536](https://insights.sbomify.com/CVE-2026-39536/): WordPress RSVP and Event Management plugin <= 2.7.16 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-39535](https://insights.sbomify.com/CVE-2026-39535/): WordPress Display Eventbrite Events plugin <= 6.5.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39534](https://insights.sbomify.com/CVE-2026-39534/): WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-39533](https://insights.sbomify.com/CVE-2026-39533/): WordPress AWP Classifieds plugin <= 4.4.4 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-39532](https://insights.sbomify.com/CVE-2026-39532/): WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-39531](https://insights.sbomify.com/CVE-2026-39531/): WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39530](https://insights.sbomify.com/CVE-2026-39530/): WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-3953](https://insights.sbomify.com/CVE-2026-3953/): Reflected XSS in Gosoft Software's Proticaret E-Commerce (high 8.8)
- [CVE-2026-39529](https://insights.sbomify.com/CVE-2026-39529/): WordPress Elementra theme <= 1.0.9 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-39528](https://insights.sbomify.com/CVE-2026-39528/): WordPress WP Delicious plugin <= 1.9.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39527](https://insights.sbomify.com/CVE-2026-39527/): WordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerability (medium 5.4)
- [CVE-2026-39526](https://insights.sbomify.com/CVE-2026-39526/): WordPress WpStream plugin < 4.11.2 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-39525](https://insights.sbomify.com/CVE-2026-39525/): WordPress Booking Activities plugin <= 1.16.48.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39524](https://insights.sbomify.com/CVE-2026-39524/): WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability (high 7.5)
- [CVE-2026-39523](https://insights.sbomify.com/CVE-2026-39523/): WordPress Solene Core plugin <= 2.3.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-39522](https://insights.sbomify.com/CVE-2026-39522/): WordPress Solene theme <= 3.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-39521](https://insights.sbomify.com/CVE-2026-39521/): WordPress Nelio Content plugin <= 4.3.1 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2026-39520](https://insights.sbomify.com/CVE-2026-39520/): WordPress weDocs plugin <= 2.1.18 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39519](https://insights.sbomify.com/CVE-2026-39519/): WordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39518](https://insights.sbomify.com/CVE-2026-39518/): WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability (high 7.1)
- [CVE-2026-39517](https://insights.sbomify.com/CVE-2026-39517/): WordPress Blog Filter plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39516](https://insights.sbomify.com/CVE-2026-39516/): WordPress Nexter Blocks plugin <= 4.7.0 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-39515](https://insights.sbomify.com/CVE-2026-39515/): WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39514](https://insights.sbomify.com/CVE-2026-39514/): WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39513](https://insights.sbomify.com/CVE-2026-39513/): WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-39512](https://insights.sbomify.com/CVE-2026-39512/): WordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39511](https://insights.sbomify.com/CVE-2026-39511/): WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39510](https://insights.sbomify.com/CVE-2026-39510/): Missing authorization in Image Photo Gallery Final Tiles Grid (low 2.7)
- [CVE-2026-3951](https://insights.sbomify.com/CVE-2026-3951/): LockerProject Locker Error Response registry.js authIsAwesome cross site scripting (medium 5.3)
- [CVE-2026-39509](https://insights.sbomify.com/CVE-2026-39509/): WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39508](https://insights.sbomify.com/CVE-2026-39508/): WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39507](https://insights.sbomify.com/CVE-2026-39507/): WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39506](https://insights.sbomify.com/CVE-2026-39506/): WordPress AI Engine (Pro) plugin < 3.4.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39505](https://insights.sbomify.com/CVE-2026-39505/): WordPress Seriously Simple Podcasting plugin <= 3.14.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39504](https://insights.sbomify.com/CVE-2026-39504/): WordPress InstaWP Connect plugin <= 0.1.2.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-39503](https://insights.sbomify.com/CVE-2026-39503/): WordPress Easy Digital Downloads plugin <= 3.6.5 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-39502](https://insights.sbomify.com/CVE-2026-39502/): WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39501](https://insights.sbomify.com/CVE-2026-39501/): WordPress FOX plugin <= 1.4.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39500](https://insights.sbomify.com/CVE-2026-39500/): WordPress themesflat-addons-for-elementor plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-3950](https://insights.sbomify.com/CVE-2026-3950/): strukturag libheif stsz/stts track.cc load out-of-bounds (medium 4.8)
- [CVE-2026-39499](https://insights.sbomify.com/CVE-2026-39499/): Deserialization in Advanced Product Fields (Product Addons) for WooCommerce (high 7.2)
- [CVE-2026-39498](https://insights.sbomify.com/CVE-2026-39498/): WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-39497](https://insights.sbomify.com/CVE-2026-39497/): WordPress FOX plugin <= 1.4.5 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-39496](https://insights.sbomify.com/CVE-2026-39496/): WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-39495](https://insights.sbomify.com/CVE-2026-39495/): WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-39494](https://insights.sbomify.com/CVE-2026-39494/): WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39493](https://insights.sbomify.com/CVE-2026-39493/): WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39492](https://insights.sbomify.com/CVE-2026-39492/): WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39491](https://insights.sbomify.com/CVE-2026-39491/): WordPress JupiterX Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39490](https://insights.sbomify.com/CVE-2026-39490/): WordPress JupiterX Core plugin <= 4.14.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-3949](https://insights.sbomify.com/CVE-2026-3949/): strukturag libheif HEIF File decoder_vvdec.cc vvdec_push_data2 out-of-bounds (medium 4.8)
- [CVE-2026-39489](https://insights.sbomify.com/CVE-2026-39489/): WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability (medium 4.4)
- [CVE-2026-39488](https://insights.sbomify.com/CVE-2026-39488/): WordPress SureCart plugin <= 4.0.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39487](https://insights.sbomify.com/CVE-2026-39487/): WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-39486](https://insights.sbomify.com/CVE-2026-39486/): WordPress Download Monitor plugin <= 5.1.8 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-39485](https://insights.sbomify.com/CVE-2026-39485/): WordPress Youtube Embed Plus plugin <= 14.2.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39484](https://insights.sbomify.com/CVE-2026-39484/): WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerability (medium 4.7)
- [CVE-2026-39483](https://insights.sbomify.com/CVE-2026-39483/): WordPress VK All in One Expansion Unit plugin <= 9.113.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39482](https://insights.sbomify.com/CVE-2026-39482/): WordPress Post Expirator plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39481](https://insights.sbomify.com/CVE-2026-39481/): WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-39480](https://insights.sbomify.com/CVE-2026-39480/): WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-39479](https://insights.sbomify.com/CVE-2026-39479/): WordPress OttoKit plugin <= 1.1.20 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-39478](https://insights.sbomify.com/CVE-2026-39478/): WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-39477](https://insights.sbomify.com/CVE-2026-39477/): WordPress CartFlows plugin <= 2.2.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39476](https://insights.sbomify.com/CVE-2026-39476/): WordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39475](https://insights.sbomify.com/CVE-2026-39475/): WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-39474](https://insights.sbomify.com/CVE-2026-39474/): WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-39473](https://insights.sbomify.com/CVE-2026-39473/): WordPress Simple History plugin <= 5.24.0 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-39472](https://insights.sbomify.com/CVE-2026-39472/): WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-39471](https://insights.sbomify.com/CVE-2026-39471/): WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-39470](https://insights.sbomify.com/CVE-2026-39470/): WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-39469](https://insights.sbomify.com/CVE-2026-39469/): WordPress PageLayer plugin <= 2.0.8 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-39468](https://insights.sbomify.com/CVE-2026-39468/): WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability (medium 6.8)
- [CVE-2026-39467](https://insights.sbomify.com/CVE-2026-39467/): WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-39466](https://insights.sbomify.com/CVE-2026-39466/): WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-39465](https://insights.sbomify.com/CVE-2026-39465/): WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2026-39464](https://insights.sbomify.com/CVE-2026-39464/): Server-side request forgery in Coming Soon Page, Under Construction & Maintenance Mode by SeedProd (medium 5.5)
- [CVE-2026-39463](https://insights.sbomify.com/CVE-2026-39463/): WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39462](https://insights.sbomify.com/CVE-2026-39462/): SenseLive X3050 Insufficiently Protected Credentials (critical 9.3)
- [CVE-2026-39461](https://insights.sbomify.com/CVE-2026-39461/): select(2) file descriptor set overflow causes stack overflow (high 8.8)
- [CVE-2026-39460](https://insights.sbomify.com/CVE-2026-39460/): Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials (critical 9.3)
- [CVE-2026-3946](https://insights.sbomify.com/CVE-2026-3946/): PHPEMS index.php cross site scripting (medium 5.1)
- [CVE-2026-39459](https://insights.sbomify.com/CVE-2026-39459/): iControl REST and tmsh vulnerability (high 8.6)
- [CVE-2026-39458](https://insights.sbomify.com/CVE-2026-39458/): BIG-IP DNS Cache vulnerability (high 8.7)
- [CVE-2026-39457](https://insights.sbomify.com/CVE-2026-39457/): Stack overflow via select() file descriptor set overflow (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/677/