# Vulnerabilities published in 2026


- [CVE-2026-32474](https://insights.sbomify.com/CVE-2026-32474/): WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-32473](https://insights.sbomify.com/CVE-2026-32473/): WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-32472](https://insights.sbomify.com/CVE-2026-32472/): WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-32471](https://insights.sbomify.com/CVE-2026-32471/): WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32470](https://insights.sbomify.com/CVE-2026-32470/): WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-32469](https://insights.sbomify.com/CVE-2026-32469/): WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability (medium 5.3)
- [CVE-2026-32468](https://insights.sbomify.com/CVE-2026-32468/): WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-32467](https://insights.sbomify.com/CVE-2026-32467/): WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability (medium 6.0)
- [CVE-2026-32466](https://insights.sbomify.com/CVE-2026-32466/): WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32465](https://insights.sbomify.com/CVE-2026-32465/): WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-32464](https://insights.sbomify.com/CVE-2026-32464/): WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-32463](https://insights.sbomify.com/CVE-2026-32463/): WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-32462](https://insights.sbomify.com/CVE-2026-32462/): WordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-32461](https://insights.sbomify.com/CVE-2026-32461/): WordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-32460](https://insights.sbomify.com/CVE-2026-32460/): WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32459](https://insights.sbomify.com/CVE-2026-32459/): WordPress UpsellWP plugin <= 2.2.4 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-32458](https://insights.sbomify.com/CVE-2026-32458/): WordPress WOLF plugin <= 1.0.8.7 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-32457](https://insights.sbomify.com/CVE-2026-32457/): Missing authorization in Advanced Product Fields (Product Addons) for WooCommerce (medium 5.3)
- [CVE-2026-32456](https://insights.sbomify.com/CVE-2026-32456/): WordPress Admin Menu Editor plugin <= 1.14.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-32455](https://insights.sbomify.com/CVE-2026-32455/): WordPress MDTF plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32454](https://insights.sbomify.com/CVE-2026-32454/): WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32453](https://insights.sbomify.com/CVE-2026-32453/): WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32452](https://insights.sbomify.com/CVE-2026-32452/): WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32451](https://insights.sbomify.com/CVE-2026-32451/): WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-32450](https://insights.sbomify.com/CVE-2026-32450/): WordPress Active Products Tables for WooCommerce plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-3245](https://insights.sbomify.com/CVE-2026-3245/): Deserialization in PRISMAproduction (high 7.7)
- [CVE-2026-32449](https://insights.sbomify.com/CVE-2026-32449/): WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32448](https://insights.sbomify.com/CVE-2026-32448/): WordPress Podlove Podcast Publisher plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32447](https://insights.sbomify.com/CVE-2026-32447/): WordPress Atarim plugin <= 4.3.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-32446](https://insights.sbomify.com/CVE-2026-32446/): WordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-32445](https://insights.sbomify.com/CVE-2026-32445/): WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability (low 2.7)
- [CVE-2026-32444](https://insights.sbomify.com/CVE-2026-32444/): WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-32443](https://insights.sbomify.com/CVE-2026-32443/): WordPress Product Feed PRO for WooCommerce plugin <= 13.5.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2026-32442](https://insights.sbomify.com/CVE-2026-32442/): WordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerability (medium 5.0)
- [CVE-2026-32441](https://insights.sbomify.com/CVE-2026-32441/): WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability (high 7.7)
- [CVE-2026-32440](https://insights.sbomify.com/CVE-2026-32440/): WordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3244](https://insights.sbomify.com/CVE-2026-3244/): Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page Names (medium 4.8)
- [CVE-2026-32439](https://insights.sbomify.com/CVE-2026-32439/): WordPress BigHearts theme <= 3.1.14 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32438](https://insights.sbomify.com/CVE-2026-32438/): WordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32437](https://insights.sbomify.com/CVE-2026-32437/): WordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32436](https://insights.sbomify.com/CVE-2026-32436/): WordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32435](https://insights.sbomify.com/CVE-2026-32435/): WordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32434](https://insights.sbomify.com/CVE-2026-32434/): WordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32433](https://insights.sbomify.com/CVE-2026-32433/): WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32432](https://insights.sbomify.com/CVE-2026-32432/): WordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32431](https://insights.sbomify.com/CVE-2026-32431/): WordPress Astra Bulk Edit plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32430](https://insights.sbomify.com/CVE-2026-32430/): WordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-3243](https://insights.sbomify.com/CVE-2026-3243/): Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal (high 8.8)
- [CVE-2026-32429](https://insights.sbomify.com/CVE-2026-32429/): WordPress Magical Addons For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32428](https://insights.sbomify.com/CVE-2026-32428/): WordPress Popup Like box plugin <= 3.7.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32427](https://insights.sbomify.com/CVE-2026-32427/): WordPress VW Education Lite plugin <= 2.2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32426](https://insights.sbomify.com/CVE-2026-32426/): WordPress Medilazar Core plugin < 1.4.7 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-32425](https://insights.sbomify.com/CVE-2026-32425/): WordPress Payment Gateway Pix For GiveWP plugin <= 2.2.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32424](https://insights.sbomify.com/CVE-2026-32424/): WordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32423](https://insights.sbomify.com/CVE-2026-32423/): WordPress Admin and Site Enhancements (ASE) plugin <= 8.4.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-32422](https://insights.sbomify.com/CVE-2026-32422/): WordPress WP EasyCart plugin <= 5.8.13 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32421](https://insights.sbomify.com/CVE-2026-32421/): WordPress Post Timeline plugin <= 2.4.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32420](https://insights.sbomify.com/CVE-2026-32420/): WordPress GamiPress plugin <= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-3242](https://insights.sbomify.com/CVE-2026-3242/): Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block (medium 4.8)
- [CVE-2026-32419](https://insights.sbomify.com/CVE-2026-32419/): WordPress List category posts plugin <= 0.93.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-32418](https://insights.sbomify.com/CVE-2026-32418/): WordPress Meow Gallery plugin <= 5.4.4 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-32417](https://insights.sbomify.com/CVE-2026-32417/): WordPress Pochipp plugin < 1.18.9 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-32416](https://insights.sbomify.com/CVE-2026-32416/): WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-32415](https://insights.sbomify.com/CVE-2026-32415/): WordPress Squeeze plugin <= 1.7.7 - Directory Traversal vulnerability (medium 5.0)
- [CVE-2026-32414](https://insights.sbomify.com/CVE-2026-32414/): WordPress Advanced Woo Labels plugin <= 2.36 - Remote Code Execution (RCE) vulnerability (high 7.2)
- [CVE-2026-32413](https://insights.sbomify.com/CVE-2026-32413/): WordPress Permalink Manager Lite plugin < 2.5.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32412](https://insights.sbomify.com/CVE-2026-32412/): Server-side request forgery in Gift Up Gift Cards for WordPress and WooCommerce (medium 5.4)
- [CVE-2026-32411](https://insights.sbomify.com/CVE-2026-32411/): WordPress Embed Calendly plugin <= 4.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32410](https://insights.sbomify.com/CVE-2026-32410/): WordPress WBW Currency Switcher for WooCommerce plugin <= 2.2.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3241](https://insights.sbomify.com/CVE-2026-3241/): Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block. (medium 4.8)
- [CVE-2026-32409](https://insights.sbomify.com/CVE-2026-32409/): WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32408](https://insights.sbomify.com/CVE-2026-32408/): WordPress Brizy plugin <= 2.7.23 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-32407](https://insights.sbomify.com/CVE-2026-32407/): WordPress WPC Smart Wishlist for WooCommerce plugin <= 5.0.8 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-32406](https://insights.sbomify.com/CVE-2026-32406/): WordPress WPC Product Bundles for WooCommerce plugin <= 8.4.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-32405](https://insights.sbomify.com/CVE-2026-32405/): WordPress WoodMart theme <= 8.3.9 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-32404](https://insights.sbomify.com/CVE-2026-32404/): WordPress Studio99 WP Monitor plugin <= 1.0.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32403](https://insights.sbomify.com/CVE-2026-32403/): WordPress Toocheke Companion plugin <= 1.194 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32402](https://insights.sbomify.com/CVE-2026-32402/): WordPress Image Slider by Ays plugin <= 2.7.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32401](https://insights.sbomify.com/CVE-2026-32401/): WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerability (high 7.2)
- [CVE-2026-32400](https://insights.sbomify.com/CVE-2026-32400/): WordPress Boldman theme <= 7.7 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-3240](https://insights.sbomify.com/CVE-2026-3240/): Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form (medium 4.8)
- [CVE-2026-32399](https://insights.sbomify.com/CVE-2026-32399/): WordPress Media LIbrary Assistant plugin <= 3.32 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32398](https://insights.sbomify.com/CVE-2026-32398/): WordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerability (medium 6.5)
- [CVE-2026-32397](https://insights.sbomify.com/CVE-2026-32397/): WordPress Filter & Grids plugin <= 3.5.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32396](https://insights.sbomify.com/CVE-2026-32396/): WordPress Team plugin <= 5.0.13 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32395](https://insights.sbomify.com/CVE-2026-32395/): WordPress Xpro Addons For Beaver Builder – Lite plugin <= 1.5.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32394](https://insights.sbomify.com/CVE-2026-32394/): WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-32393](https://insights.sbomify.com/CVE-2026-32393/): WordPress Greenly Theme Addons plugin < 8.2 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-32392](https://insights.sbomify.com/CVE-2026-32392/): WordPress Greenly theme <= 8.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-32391](https://insights.sbomify.com/CVE-2026-32391/): WordPress SmartFix theme < 1.2.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-32390](https://insights.sbomify.com/CVE-2026-32390/): WordPress Nanosoft theme < 1.3.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-3239](https://insights.sbomify.com/CVE-2026-3239/): Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode (medium 6.4)
- [CVE-2026-32389](https://insights.sbomify.com/CVE-2026-32389/): WordPress NanoCare theme < 1.2.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-32388](https://insights.sbomify.com/CVE-2026-32388/): WordPress GLB theme <= 1.2.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-32387](https://insights.sbomify.com/CVE-2026-32387/): WordPress Checkout for PayPal plugin <= 1.0.46 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32386](https://insights.sbomify.com/CVE-2026-32386/): WordPress Envo Extra plugin <= 1.9.13 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-32385](https://insights.sbomify.com/CVE-2026-32385/): WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-32384](https://insights.sbomify.com/CVE-2026-32384/): WordPress WpBookingly plugin <= 1.2.9 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-32383](https://insights.sbomify.com/CVE-2026-32383/): WordPress Ridhi theme <= 1.1.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32382](https://insights.sbomify.com/CVE-2026-32382/): WordPress Digital Download theme <= 1.1.4 - Broken Access Control vulnerability (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/719/