Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 718 of 1013.
- CVE-2026-32569 WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32568 WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability
- CVE-2026-32567 WordPress YML for Yandex Market plugin < 5.3.0 - Arbitrary File Deletion vulnerability
- CVE-2026-32566 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability
- CVE-2026-32565 WordPress Contextual Related Posts plugin < 4.2.2 - Broken Access Control vulnerability
- CVE-2026-32564 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability
- CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
- CVE-2026-32562 WordPress PPWP plugin <= 1.9.15 - Broken Access Control vulnerability
- CVE-2026-32561 WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability
- CVE-2026-32560 Path traversal in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator
- CVE-2026-3256 HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids
- CVE-2026-32559 WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability
- CVE-2026-32558 Privilege escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress
- CVE-2026-32557 WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability
- CVE-2026-32556 WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32555 WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability
- CVE-2026-32554 WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability
- CVE-2026-32553 WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-32552 WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability
- CVE-2026-32551 WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability
- CVE-2026-32550 WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability
- CVE-2026-3255 HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function
- CVE-2026-32549 WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability
- CVE-2026-32548 WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability
- CVE-2026-32547 WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32546 WordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerability
- CVE-2026-32545 WordPress Taboola Pixel plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-32544 WordPress OOPSpam Anti-Spam plugin <= 1.2.62 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32543 WordPress Responsive Blocks plugin <= 2.2.0 - Broken Access Control vulnerability
- CVE-2026-32542 WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-32541 WordPress Premmerce Redirect Manager plugin <= 1.0.12 - Broken Access Control vulnerability
- CVE-2026-32540 WordPress Bookly plugin <= 26.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-3254 Improper Restriction of Rendered UI Layers or Frames in GitLab
- CVE-2026-32539 WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerability
- CVE-2026-32538 WordPress SMTP Mailer plugin <= 1.1.24 - Sensitive Data Exposure vulnerability
- CVE-2026-32537 WordPress Visual Portfolio, Photo Gallery & Post Grid plugin <= 3.5.1 - Local File Inclusion vulnerability
- CVE-2026-32536 WordPress Green Downloads plugin <= 2.08 - Arbitrary File Upload vulnerability
- CVE-2026-32535 WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-32534 WordPress JS Help Desk plugin <= 3.0.3 - SQL Injection vulnerability
- CVE-2026-32533 WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-32532 WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32531 WordPress Kunco theme < 1.4.5 - Local File Inclusion vulnerability
- CVE-2026-32530 WordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerability
- CVE-2026-3253 Missing authorization in MailerLite – Signup forms (official)
- CVE-2026-32529 WordPress Molla theme < 1.5.19 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-32528 WordPress Riode | Multi-Purpose WooCommerce theme < 1.6.29 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-32527 Missing authorization in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
- CVE-2026-32526 WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32525 WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability
- CVE-2026-32524 WordPress Photo Engine plugin <= 6.4.9 - Arbitrary File Upload vulnerability
- CVE-2026-32523 WordPress WPJAM Basic plugin <= 6.9.2 - Arbitrary File Upload vulnerability
- CVE-2026-32522 WordPress WooCommerce Support Ticket System plugin < 18.5 - Arbitrary File Deletion vulnerability
- CVE-2026-32521 WordPress WP Custom Admin Interface plugin <= 7.42 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32520 WordPress RewardsWP plugin <= 1.0.4 - Privilege Escalation vulnerability
- CVE-2026-32519 WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability
- CVE-2026-32518 WordPress Gaea theme < 3.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-32517 WordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-32516 WordPress Miraculous Core Plugin plugin < 2.1.2 - SQL Injection vulnerability
- CVE-2026-32515 WordPress Miraculous theme < 2.1.2 - Broken Access Control vulnerability
- CVE-2026-32514 WordPress Petitioner plugin <= 0.7.3 - Broken Access Control vulnerability
- CVE-2026-32513 WordPress JS Archive List plugin <= 6.1.7 - PHP Object Injection vulnerability
- CVE-2026-32512 WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability
- CVE-2026-32511 WordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability
- CVE-2026-32510 WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability
- CVE-2026-3251 XSS in Webremium's Mezunum Satiyorum
- CVE-2026-32509 WordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerability
- CVE-2026-32508 WordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerability
- CVE-2026-32507 WordPress Leroux theme < 1.4 - Arbitrary Object Instantiation vulnerability
- CVE-2026-32506 WordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerability
- CVE-2026-32505 WordPress Kiddy theme <= 2.0.8 - Local File Inclusion vulnerability
- CVE-2026-32504 WordPress VintWood theme <= 1.1.8 - Local File Inclusion vulnerability
- CVE-2026-32503 WordPress Trendustry theme <= 1.1.4 - Local File Inclusion vulnerability
- CVE-2026-32502 WordPress Borgholm theme < 1.6 - PHP Object Injection vulnerability
- CVE-2026-32501 WordPress WP Configurator Pro plugin <= 3.7.9 - Broken Access Control vulnerability
- CVE-2026-32500 WordPress MetaMax theme <= 1.1.4 - Local File Inclusion vulnerability
- CVE-2026-32499 WordPress ChatBot plugin <= 7.7.9 - SQL Injection vulnerability
- CVE-2026-32498 WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability
- CVE-2026-32497 WordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerability
- CVE-2026-32496 WordPress Spam Protect for Contact Form 7 plugin <= 1.2.9 - Arbitrary File Deletion vulnerability
- CVE-2026-32495 WordPress WP Terms Popup plugin <= 2.10.0 - Broken Access Control vulnerability
- CVE-2026-32494 WordPress Image Slider by Ays plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32493 WordPress JobSearch plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-32492 WordPress My Tickets plugin <= 2.1.1 - Bypass Vulnerability vulnerability
- CVE-2026-32491 WordPress WP Review Slider plugin <= 13.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32490 WordPress WP TripAdvisor Review Slider plugin <= 14.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32489 WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability
- CVE-2026-32488 WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability
- CVE-2026-32487 WordPress Lawyer Landing Page theme <= 1.2.7 - Broken Access Control vulnerability
- CVE-2026-32486 WordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerability
- CVE-2026-32485 WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability
- CVE-2026-32484 WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability
- CVE-2026-32483 WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerability
- CVE-2026-32482 WordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability
- CVE-2026-32481 WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability
- CVE-2026-32480 WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability
- CVE-2026-32479 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability
- CVE-2026-32478 WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability
- CVE-2026-32477 Path traversal in ShopBuilder Pro – Elementor WooCommerce Builder Addons
- CVE-2026-32476 WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability