# Vulnerabilities published in 2026 - [CVE-2026-28170](https://insights.sbomify.com/CVE-2026-28170/): WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-2817](https://insights.sbomify.com/CVE-2026-2817/): Spring Data Geode Insecure Temporary Directory Usage (medium 4.8) - [CVE-2026-28169](https://insights.sbomify.com/CVE-2026-28169/): WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability (medium 5.3) - [CVE-2026-28168](https://insights.sbomify.com/CVE-2026-28168/): WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability (high 8.5) - [CVE-2026-28167](https://insights.sbomify.com/CVE-2026-28167/): WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability (high 7.5) - [CVE-2026-28166](https://insights.sbomify.com/CVE-2026-28166/): WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28165](https://insights.sbomify.com/CVE-2026-28165/): WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability (critical 9.8) - [CVE-2026-28164](https://insights.sbomify.com/CVE-2026-28164/): WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability (critical 9.6) - [CVE-2026-28163](https://insights.sbomify.com/CVE-2026-28163/): WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-28162](https://insights.sbomify.com/CVE-2026-28162/): WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28161](https://insights.sbomify.com/CVE-2026-28161/): WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability (high 8.8) - [CVE-2026-28159](https://insights.sbomify.com/CVE-2026-28159/): WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability (medium 6.5) - [CVE-2026-28158](https://insights.sbomify.com/CVE-2026-28158/): WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28157](https://insights.sbomify.com/CVE-2026-28157/): WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability (high 7.5) - [CVE-2026-28156](https://insights.sbomify.com/CVE-2026-28156/): WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability (high 8.5) - [CVE-2026-28155](https://insights.sbomify.com/CVE-2026-28155/): WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5) - [CVE-2026-28154](https://insights.sbomify.com/CVE-2026-28154/): WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28153](https://insights.sbomify.com/CVE-2026-28153/): Missing authorization in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More (high 7.5) - [CVE-2026-28152](https://insights.sbomify.com/CVE-2026-28152/): WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28151](https://insights.sbomify.com/CVE-2026-28151/): WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28150](https://insights.sbomify.com/CVE-2026-28150/): WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-2815](https://insights.sbomify.com/CVE-2026-2815/): Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys (high 8.4) - [CVE-2026-28149](https://insights.sbomify.com/CVE-2026-28149/): WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability (critical 9.8) - [CVE-2026-28148](https://insights.sbomify.com/CVE-2026-28148/): WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability (critical 9.8) - [CVE-2026-28147](https://insights.sbomify.com/CVE-2026-28147/): Missing authorization in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (medium 5.4) - [CVE-2026-28146](https://insights.sbomify.com/CVE-2026-28146/): Path traversal in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (medium 6.5) - [CVE-2026-28145](https://insights.sbomify.com/CVE-2026-28145/): WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-28144](https://insights.sbomify.com/CVE-2026-28144/): WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability (medium 4.3) - [CVE-2026-28143](https://insights.sbomify.com/CVE-2026-28143/): WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28142](https://insights.sbomify.com/CVE-2026-28142/): WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability (critical 9.3) - [CVE-2026-28141](https://insights.sbomify.com/CVE-2026-28141/): WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28140](https://insights.sbomify.com/CVE-2026-28140/): WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability (high 7.5) - [CVE-2026-28139](https://insights.sbomify.com/CVE-2026-28139/): WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability (critical 9.8) - [CVE-2026-28138](https://insights.sbomify.com/CVE-2026-28138/): WordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability (high 7.2) - [CVE-2026-28137](https://insights.sbomify.com/CVE-2026-28137/): Cross-site scripting in MediCenter - Health Medical Clinic (high 7.1) - [CVE-2026-28136](https://insights.sbomify.com/CVE-2026-28136/): WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability (high 7.6) - [CVE-2026-28135](https://insights.sbomify.com/CVE-2026-28135/): WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerability (high 8.2) - [CVE-2026-28134](https://insights.sbomify.com/CVE-2026-28134/): WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability (high 8.5) - [CVE-2026-28133](https://insights.sbomify.com/CVE-2026-28133/): WordPress Filr plugin <= 1.2.14 - Arbitrary File Upload vulnerability (high 8.5) - [CVE-2026-28132](https://insights.sbomify.com/CVE-2026-28132/): WordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerability (medium 5.3) - [CVE-2026-28131](https://insights.sbomify.com/CVE-2026-28131/): WordPress Elementor Addon Elements plugin <= 1.14.4 - Sensitive Data Exposure vulnerability (medium 6.5) - [CVE-2026-28130](https://insights.sbomify.com/CVE-2026-28130/): WordPress UDesign theme <= 4.14.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-2813](https://insights.sbomify.com/CVE-2026-2813/): Unvalidated Redirect in ArcGIS Server (medium 4.7) - [CVE-2026-28129](https://insights.sbomify.com/CVE-2026-28129/): WordPress Little Birdies theme <= 1.3.16 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28128](https://insights.sbomify.com/CVE-2026-28128/): WordPress Verse theme <= 1.7.0 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28127](https://insights.sbomify.com/CVE-2026-28127/): WordPress Lawyer Directory plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28126](https://insights.sbomify.com/CVE-2026-28126/): WordPress RH Frontend Publishing Pro plugin < 4.3.4 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28125](https://insights.sbomify.com/CVE-2026-28125/): WordPress Midi theme <= 1.14 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28124](https://insights.sbomify.com/CVE-2026-28124/): WordPress Notarius theme <= 1.9 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28123](https://insights.sbomify.com/CVE-2026-28123/): WordPress Veil theme <= 1.9 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28122](https://insights.sbomify.com/CVE-2026-28122/): WordPress ListingPro plugin <= 2.9.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28121](https://insights.sbomify.com/CVE-2026-28121/): WordPress Anderson theme <= 1.4.2 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28120](https://insights.sbomify.com/CVE-2026-28120/): WordPress Dr.Patterson theme <= 1.3.2 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-2812](https://insights.sbomify.com/CVE-2026-2812/): Improper Authentication issue in ArcGIS Server (medium 5.3) - [CVE-2026-28119](https://insights.sbomify.com/CVE-2026-28119/): WordPress Nirvana theme <= 2.6 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28118](https://insights.sbomify.com/CVE-2026-28118/): WordPress Welldone theme <= 2.4 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28117](https://insights.sbomify.com/CVE-2026-28117/): WordPress smart SEO theme <= 2.9 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28116](https://insights.sbomify.com/CVE-2026-28116/): WordPress Progress Planner plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2026-28115](https://insights.sbomify.com/CVE-2026-28115/): WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - SQL Injection vulnerability (critical 9.3) - [CVE-2026-28114](https://insights.sbomify.com/CVE-2026-28114/): WordPress WooCommerce License Manager plugin <= 7.0.6 - Arbitrary File Upload vulnerability (critical 9.1) - [CVE-2026-28113](https://insights.sbomify.com/CVE-2026-28113/): WordPress Ultimate Learning Pro plugin <= 3.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28112](https://insights.sbomify.com/CVE-2026-28112/): WordPress AllInOne - Banner Rotator plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28111](https://insights.sbomify.com/CVE-2026-28111/): WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability (high 8.8) - [CVE-2026-28110](https://insights.sbomify.com/CVE-2026-28110/): Cross-site scripting in LambertGroup - AllInOne - Banner with Playlist (high 7.1) - [CVE-2026-2811](https://insights.sbomify.com/CVE-2026-2811/): Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection (medium 5.4) - [CVE-2026-28109](https://insights.sbomify.com/CVE-2026-28109/): WordPress LambertGroup - AllInOne - Content Slider plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28108](https://insights.sbomify.com/CVE-2026-28108/): Cross-site scripting in LambertGroup - AllInOne - Banner with Thumbnails (high 7.1) - [CVE-2026-28107](https://insights.sbomify.com/CVE-2026-28107/): WordPress Muzicon theme <= 1.9.0 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28106](https://insights.sbomify.com/CVE-2026-28106/): WordPress B2BKing Premium plugin < 5.4.20 - Open Redirection vulnerability (medium 4.7) - [CVE-2026-28105](https://insights.sbomify.com/CVE-2026-28105/): WordPress Good Energy theme <= 1.7.7 - PHP Object Injection vulnerability (critical 9.8) - [CVE-2026-28104](https://insights.sbomify.com/CVE-2026-28104/): WordPress Site Suggest plugin <= 1.3.9 - Broken Access Control vulnerability (medium 6.5) - [CVE-2026-28103](https://insights.sbomify.com/CVE-2026-28103/): WordPress LBG Zoominoutslider plugin <= 5.4.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28102](https://insights.sbomify.com/CVE-2026-28102/): WordPress UberSlider Classic plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28101](https://insights.sbomify.com/CVE-2026-28101/): WordPress UberSlider MouseInteraction plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28100](https://insights.sbomify.com/CVE-2026-28100/): WordPress UberSlider PerpetuumMobile plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-2810](https://insights.sbomify.com/CVE-2026-2810/): Endpoint DLP Driver Out-of-Bounds Read (medium 6.8) - [CVE-2026-28099](https://insights.sbomify.com/CVE-2026-28099/): WordPress UberSlider Ultra plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28098](https://insights.sbomify.com/CVE-2026-28098/): WordPress Save Life theme <= 1.2.13 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28097](https://insights.sbomify.com/CVE-2026-28097/): WordPress Artrium theme <= 1.0.14 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28096](https://insights.sbomify.com/CVE-2026-28096/): WordPress WealthCo theme <= 2.18 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28095](https://insights.sbomify.com/CVE-2026-28095/): WordPress Marcell theme <= 1.2.14 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28094](https://insights.sbomify.com/CVE-2026-28094/): WordPress RexCoin theme <= 1.2.6 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28093](https://insights.sbomify.com/CVE-2026-28093/): WordPress Ozisti theme <= 1.1.10 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28092](https://insights.sbomify.com/CVE-2026-28092/): WordPress Sounder theme <= 1.3.11 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28091](https://insights.sbomify.com/CVE-2026-28091/): WordPress Coleo theme <= 1.1.7 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28090](https://insights.sbomify.com/CVE-2026-28090/): WordPress Gamezone theme <= 1.1.11 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-2809](https://insights.sbomify.com/CVE-2026-2809/): Endpoint DLP Driver DLL (medium 6.7) - [CVE-2026-28089](https://insights.sbomify.com/CVE-2026-28089/): WordPress Daiquiri theme <= 1.2.4 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28088](https://insights.sbomify.com/CVE-2026-28088/): WordPress Aqualots theme <= 1.1.6 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28087](https://insights.sbomify.com/CVE-2026-28087/): WordPress Filmax theme <= 1.1.11 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28086](https://insights.sbomify.com/CVE-2026-28086/): WordPress Run Gran theme <= 2.0 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28085](https://insights.sbomify.com/CVE-2026-28085/): WordPress Mahogany theme <= 2.9 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28084](https://insights.sbomify.com/CVE-2026-28084/): WordPress Bazinga theme <= 1.1.9 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28083](https://insights.sbomify.com/CVE-2026-28083/): WordPress Flatsome theme <= 3.20.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-28082](https://insights.sbomify.com/CVE-2026-28082/): WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-28081](https://insights.sbomify.com/CVE-2026-28081/): WordPress Windsor theme <= 2.5.0 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28080](https://insights.sbomify.com/CVE-2026-28080/): WordPress Rank Math SEO PRO plugin <= 3.0.95 - Broken Access Control vulnerability (medium 4.3) - [CVE-2026-2808](https://insights.sbomify.com/CVE-2026-2808/): Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider (medium 6.8) - [CVE-2026-28079](https://insights.sbomify.com/CVE-2026-28079/): WordPress Conquerors theme <= 1.2.13 - Local File Inclusion vulnerability (high 8.1) - [CVE-2026-28078](https://insights.sbomify.com/CVE-2026-28078/): WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability (medium 4.9) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/748/