Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 719 of 1013.
- CVE-2026-32474 WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability
- CVE-2026-32473 WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-32472 WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability
- CVE-2026-32471 WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability
- CVE-2026-32470 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
- CVE-2026-32469 WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability
- CVE-2026-32468 WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability
- CVE-2026-32467 WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability
- CVE-2026-32465 WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability
- CVE-2026-32464 WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability
- CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability
- CVE-2026-32462 WordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32461 WordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerability
- CVE-2026-32460 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32459 WordPress UpsellWP plugin <= 2.2.4 - SQL Injection vulnerability
- CVE-2026-32458 WordPress WOLF plugin <= 1.0.8.7 - SQL Injection vulnerability
- CVE-2026-32457 Missing authorization in Advanced Product Fields (Product Addons) for WooCommerce
- CVE-2026-32456 WordPress Admin Menu Editor plugin <= 1.14.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-32455 WordPress MDTF plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32454 WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32453 WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability
- CVE-2026-32452 WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability
- CVE-2026-32451 WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability
- CVE-2026-32450 WordPress Active Products Tables for WooCommerce plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3245 Deserialization in PRISMAproduction
- CVE-2026-32449 WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32448 WordPress Podlove Podcast Publisher plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32447 WordPress Atarim plugin <= 4.3.2 - Broken Access Control vulnerability
- CVE-2026-32446 WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability
- CVE-2026-32445 WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability
- CVE-2026-32444 WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability
- CVE-2026-32443 WordPress Product Feed PRO for WooCommerce plugin <= 13.5.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-32442 WordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerability
- CVE-2026-32441 WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability
- CVE-2026-32440 WordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability
- CVE-2026-3244 Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page Names
- CVE-2026-32439 WordPress BigHearts theme <= 3.1.14 - Broken Access Control vulnerability
- CVE-2026-32438 WordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability
- CVE-2026-32437 WordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerability
- CVE-2026-32436 WordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerability
- CVE-2026-32435 WordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability
- CVE-2026-32434 WordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerability
- CVE-2026-32433 WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerability
- CVE-2026-32432 WordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerability
- CVE-2026-32431 WordPress Astra Bulk Edit plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32430 WordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-3243 Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal
- CVE-2026-32429 WordPress Magical Addons For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32428 WordPress Popup Like box plugin <= 3.7.7 - Broken Access Control vulnerability
- CVE-2026-32427 WordPress VW Education Lite plugin <= 2.2.0 - Broken Access Control vulnerability
- CVE-2026-32426 WordPress Medilazar Core plugin < 1.4.7 - Local File Inclusion vulnerability
- CVE-2026-32425 WordPress Payment Gateway Pix For GiveWP plugin <= 2.2.3 - Broken Access Control vulnerability
- CVE-2026-32424 WordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32423 WordPress Admin and Site Enhancements (ASE) plugin <= 8.4.0 - Broken Access Control vulnerability
- CVE-2026-32422 WordPress WP EasyCart plugin <= 5.8.13 - SQL Injection vulnerability
- CVE-2026-32421 WordPress Post Timeline plugin <= 2.4.1 - Broken Access Control vulnerability
- CVE-2026-32420 WordPress GamiPress plugin <= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-3242 Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block
- CVE-2026-32419 WordPress List category posts plugin <= 0.93.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32418 WordPress Meow Gallery plugin <= 5.4.4 - SQL Injection vulnerability
- CVE-2026-32417 WordPress Pochipp plugin < 1.18.9 - Broken Access Control vulnerability
- CVE-2026-32416 WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability
- CVE-2026-32415 WordPress Squeeze plugin <= 1.7.7 - Directory Traversal vulnerability
- CVE-2026-32414 WordPress Advanced Woo Labels plugin <= 2.36 - Remote Code Execution (RCE) vulnerability
- CVE-2026-32413 WordPress Permalink Manager Lite plugin < 2.5.3 - Broken Access Control vulnerability
- CVE-2026-32412 Server-side request forgery in Gift Up Gift Cards for WordPress and WooCommerce
- CVE-2026-32411 WordPress Embed Calendly plugin <= 4.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32410 WordPress WBW Currency Switcher for WooCommerce plugin <= 2.2.5 - Broken Access Control vulnerability
- CVE-2026-3241 Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block.
- CVE-2026-32409 WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability
- CVE-2026-32408 WordPress Brizy plugin <= 2.7.23 - Broken Access Control vulnerability
- CVE-2026-32407 WordPress WPC Smart Wishlist for WooCommerce plugin <= 5.0.8 - Broken Access Control vulnerability
- CVE-2026-32406 WordPress WPC Product Bundles for WooCommerce plugin <= 8.4.5 - Broken Access Control vulnerability
- CVE-2026-32405 WordPress WoodMart theme <= 8.3.9 - Sensitive Data Exposure vulnerability
- CVE-2026-32404 WordPress Studio99 WP Monitor plugin <= 1.0.3 - Broken Access Control vulnerability
- CVE-2026-32403 WordPress Toocheke Companion plugin <= 1.194 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32402 WordPress Image Slider by Ays plugin <= 2.7.1 - Broken Access Control vulnerability
- CVE-2026-32401 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerability
- CVE-2026-32400 WordPress Boldman theme <= 7.7 - Local File Inclusion vulnerability
- CVE-2026-3240 Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form
- CVE-2026-32399 WordPress Media LIbrary Assistant plugin <= 3.32 - SQL Injection vulnerability
- CVE-2026-32398 WordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerability
- CVE-2026-32397 WordPress Filter & Grids plugin <= 3.5.1 - Broken Access Control vulnerability
- CVE-2026-32396 WordPress Team plugin <= 5.0.13 - Broken Access Control vulnerability
- CVE-2026-32395 WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.6 - Broken Access Control vulnerability
- CVE-2026-32394 WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability
- CVE-2026-32393 WordPress Greenly Theme Addons plugin < 8.2 - Local File Inclusion vulnerability
- CVE-2026-32392 WordPress Greenly theme <= 8.1 - Local File Inclusion vulnerability
- CVE-2026-32391 WordPress SmartFix theme < 1.2.4 - Broken Access Control vulnerability
- CVE-2026-32390 WordPress Nanosoft theme < 1.3.2 - Broken Access Control vulnerability
- CVE-2026-3239 Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode
- CVE-2026-32389 WordPress NanoCare theme < 1.2.2 - Broken Access Control vulnerability
- CVE-2026-32388 WordPress GLB theme <= 1.2.2 - Broken Access Control vulnerability
- CVE-2026-32387 WordPress Checkout for PayPal plugin <= 1.0.46 - Broken Access Control vulnerability
- CVE-2026-32386 WordPress Envo Extra plugin <= 1.9.13 - Broken Access Control vulnerability
- CVE-2026-32385 WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability
- CVE-2026-32384 WordPress WpBookingly plugin <= 1.2.9 - Local File Inclusion vulnerability
- CVE-2026-32383 WordPress Ridhi theme <= 1.1.2 - Broken Access Control vulnerability
- CVE-2026-32382 WordPress Digital Download theme <= 1.1.4 - Broken Access Control vulnerability