# Vulnerabilities published in 2026


- [CVE-2026-32569](https://insights.sbomify.com/CVE-2026-32569/): WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32568](https://insights.sbomify.com/CVE-2026-32568/): WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-32567](https://insights.sbomify.com/CVE-2026-32567/): WordPress YML for Yandex Market plugin < 5.3.0 - Arbitrary File Deletion vulnerability (medium 6.8)
- [CVE-2026-32566](https://insights.sbomify.com/CVE-2026-32566/): WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-32565](https://insights.sbomify.com/CVE-2026-32565/): WordPress Contextual Related Posts plugin < 4.2.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32564](https://insights.sbomify.com/CVE-2026-32564/): WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32563](https://insights.sbomify.com/CVE-2026-32563/): WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-32562](https://insights.sbomify.com/CVE-2026-32562/): WordPress PPWP plugin <= 1.9.15 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-32561](https://insights.sbomify.com/CVE-2026-32561/): WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-32560](https://insights.sbomify.com/CVE-2026-32560/): Path traversal in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator (high 8.8)
- [CVE-2026-3256](https://insights.sbomify.com/CVE-2026-3256/): HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids (critical 9.8)
- [CVE-2026-32559](https://insights.sbomify.com/CVE-2026-32559/): WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-32558](https://insights.sbomify.com/CVE-2026-32558/): Privilege escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress (critical 9.8)
- [CVE-2026-32557](https://insights.sbomify.com/CVE-2026-32557/): WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-32556](https://insights.sbomify.com/CVE-2026-32556/): WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32555](https://insights.sbomify.com/CVE-2026-32555/): WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-32554](https://insights.sbomify.com/CVE-2026-32554/): WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-32553](https://insights.sbomify.com/CVE-2026-32553/): WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-32552](https://insights.sbomify.com/CVE-2026-32552/): WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32551](https://insights.sbomify.com/CVE-2026-32551/): WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-32550](https://insights.sbomify.com/CVE-2026-32550/): WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-3255](https://insights.sbomify.com/CVE-2026-3255/): HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function (medium 6.5)
- [CVE-2026-32549](https://insights.sbomify.com/CVE-2026-32549/): WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-32548](https://insights.sbomify.com/CVE-2026-32548/): WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32547](https://insights.sbomify.com/CVE-2026-32547/): WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32546](https://insights.sbomify.com/CVE-2026-32546/): WordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-32545](https://insights.sbomify.com/CVE-2026-32545/): WordPress Taboola Pixel plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32544](https://insights.sbomify.com/CVE-2026-32544/): WordPress OOPSpam Anti-Spam plugin <= 1.2.62 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32543](https://insights.sbomify.com/CVE-2026-32543/): WordPress Responsive Blocks plugin <= 2.2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32542](https://insights.sbomify.com/CVE-2026-32542/): WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32541](https://insights.sbomify.com/CVE-2026-32541/): WordPress Premmerce Redirect Manager plugin <= 1.0.12 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-32540](https://insights.sbomify.com/CVE-2026-32540/): WordPress Bookly plugin <= 26.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-3254](https://insights.sbomify.com/CVE-2026-3254/): Improper Restriction of Rendered UI Layers or Frames in GitLab (low 3.5)
- [CVE-2026-32539](https://insights.sbomify.com/CVE-2026-32539/): WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-32538](https://insights.sbomify.com/CVE-2026-32538/): WordPress SMTP Mailer plugin <= 1.1.24 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-32537](https://insights.sbomify.com/CVE-2026-32537/): WordPress Visual Portfolio, Photo Gallery & Post Grid plugin <= 3.5.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-32536](https://insights.sbomify.com/CVE-2026-32536/): WordPress Green Downloads plugin <= 2.08 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-32535](https://insights.sbomify.com/CVE-2026-32535/): WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-32534](https://insights.sbomify.com/CVE-2026-32534/): WordPress JS Help Desk plugin <= 3.0.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32533](https://insights.sbomify.com/CVE-2026-32533/): WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-32532](https://insights.sbomify.com/CVE-2026-32532/): WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32531](https://insights.sbomify.com/CVE-2026-32531/): WordPress Kunco theme < 1.4.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-32530](https://insights.sbomify.com/CVE-2026-32530/): WordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-3253](https://insights.sbomify.com/CVE-2026-3253/): Missing authorization in MailerLite – Signup forms (official) (medium 4.3)
- [CVE-2026-32529](https://insights.sbomify.com/CVE-2026-32529/): WordPress Molla theme < 1.5.19 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32528](https://insights.sbomify.com/CVE-2026-32528/): WordPress Riode | Multi-Purpose WooCommerce theme < 1.6.29 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32527](https://insights.sbomify.com/CVE-2026-32527/): Missing authorization in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms (medium 6.5)
- [CVE-2026-32526](https://insights.sbomify.com/CVE-2026-32526/): WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32525](https://insights.sbomify.com/CVE-2026-32525/): WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-32524](https://insights.sbomify.com/CVE-2026-32524/): WordPress Photo Engine plugin <= 6.4.9 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2026-32523](https://insights.sbomify.com/CVE-2026-32523/): WordPress WPJAM Basic plugin <= 6.9.2 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-32522](https://insights.sbomify.com/CVE-2026-32522/): WordPress WooCommerce Support Ticket System plugin < 18.5 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2026-32521](https://insights.sbomify.com/CVE-2026-32521/): WordPress WP Custom Admin Interface plugin <= 7.42 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32520](https://insights.sbomify.com/CVE-2026-32520/): WordPress RewardsWP plugin <= 1.0.4 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-32519](https://insights.sbomify.com/CVE-2026-32519/): WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability (critical 9.0)
- [CVE-2026-32518](https://insights.sbomify.com/CVE-2026-32518/): WordPress Gaea theme < 3.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32517](https://insights.sbomify.com/CVE-2026-32517/): WordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32516](https://insights.sbomify.com/CVE-2026-32516/): WordPress Miraculous Core Plugin plugin < 2.1.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32515](https://insights.sbomify.com/CVE-2026-32515/): WordPress Miraculous theme < 2.1.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-32514](https://insights.sbomify.com/CVE-2026-32514/): WordPress Petitioner plugin <= 0.7.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-32513](https://insights.sbomify.com/CVE-2026-32513/): WordPress JS Archive List plugin <= 6.1.7 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-32512](https://insights.sbomify.com/CVE-2026-32512/): WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-32511](https://insights.sbomify.com/CVE-2026-32511/): WordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability (medium 5.4)
- [CVE-2026-32510](https://insights.sbomify.com/CVE-2026-32510/): WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability (medium 5.4)
- [CVE-2026-3251](https://insights.sbomify.com/CVE-2026-3251/): XSS in Webremium's Mezunum Satiyorum (medium 6.4)
- [CVE-2026-32509](https://insights.sbomify.com/CVE-2026-32509/): WordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerability (medium 5.4)
- [CVE-2026-32508](https://insights.sbomify.com/CVE-2026-32508/): WordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerability (medium 5.4)
- [CVE-2026-32507](https://insights.sbomify.com/CVE-2026-32507/): WordPress Leroux theme < 1.4 - Arbitrary Object Instantiation vulnerability (medium 5.4)
- [CVE-2026-32506](https://insights.sbomify.com/CVE-2026-32506/): WordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerability (medium 5.4)
- [CVE-2026-32505](https://insights.sbomify.com/CVE-2026-32505/): WordPress Kiddy theme <= 2.0.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-32504](https://insights.sbomify.com/CVE-2026-32504/): WordPress VintWood theme <= 1.1.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-32503](https://insights.sbomify.com/CVE-2026-32503/): WordPress Trendustry theme <= 1.1.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-32502](https://insights.sbomify.com/CVE-2026-32502/): WordPress Borgholm theme < 1.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-32501](https://insights.sbomify.com/CVE-2026-32501/): WordPress WP Configurator Pro plugin <= 3.7.9 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-32500](https://insights.sbomify.com/CVE-2026-32500/): WordPress MetaMax theme <= 1.1.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-32499](https://insights.sbomify.com/CVE-2026-32499/): WordPress ChatBot plugin <= 7.7.9 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-32498](https://insights.sbomify.com/CVE-2026-32498/): WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-32497](https://insights.sbomify.com/CVE-2026-32497/): WordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerability (medium 5.3)
- [CVE-2026-32496](https://insights.sbomify.com/CVE-2026-32496/): WordPress Spam Protect for Contact Form 7 plugin <= 1.2.9 - Arbitrary File Deletion vulnerability (medium 6.8)
- [CVE-2026-32495](https://insights.sbomify.com/CVE-2026-32495/): WordPress WP Terms Popup plugin <= 2.10.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-32494](https://insights.sbomify.com/CVE-2026-32494/): WordPress Image Slider by Ays plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32493](https://insights.sbomify.com/CVE-2026-32493/): WordPress JobSearch plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32492](https://insights.sbomify.com/CVE-2026-32492/): WordPress My Tickets plugin <= 2.1.1 - Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2026-32491](https://insights.sbomify.com/CVE-2026-32491/): WordPress WP Review Slider plugin <= 13.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32490](https://insights.sbomify.com/CVE-2026-32490/): WordPress WP TripAdvisor Review Slider plugin <= 14.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32489](https://insights.sbomify.com/CVE-2026-32489/): WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-32488](https://insights.sbomify.com/CVE-2026-32488/): WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability (high 8.1)
- [CVE-2026-32487](https://insights.sbomify.com/CVE-2026-32487/): WordPress Lawyer Landing Page theme <= 1.2.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32486](https://insights.sbomify.com/CVE-2026-32486/): WordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32485](https://insights.sbomify.com/CVE-2026-32485/): WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-32484](https://insights.sbomify.com/CVE-2026-32484/): WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-32483](https://insights.sbomify.com/CVE-2026-32483/): WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-32482](https://insights.sbomify.com/CVE-2026-32482/): WordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-32481](https://insights.sbomify.com/CVE-2026-32481/): WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-32480](https://insights.sbomify.com/CVE-2026-32480/): WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32479](https://insights.sbomify.com/CVE-2026-32479/): WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-32478](https://insights.sbomify.com/CVE-2026-32478/): WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32477](https://insights.sbomify.com/CVE-2026-32477/): Path traversal in ShopBuilder Pro – Elementor WooCommerce Builder Addons (high 8.6)
- [CVE-2026-32476](https://insights.sbomify.com/CVE-2026-32476/): WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32475](https://insights.sbomify.com/CVE-2026-32475/): WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability (critical 9.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/718/