# Vulnerabilities published in 2026


- [CVE-2026-28077](https://insights.sbomify.com/CVE-2026-28077/): WordPress Vapester theme <= 1.1.10 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28076](https://insights.sbomify.com/CVE-2026-28076/): WordPress Guff theme <= 1.0.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-28075](https://insights.sbomify.com/CVE-2026-28075/): WordPress Porto theme <= 7.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-28074](https://insights.sbomify.com/CVE-2026-28074/): WordPress Pizza House theme <= 1.4.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-28073](https://insights.sbomify.com/CVE-2026-28073/): WordPress WP eMember theme <= v10.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-28072](https://insights.sbomify.com/CVE-2026-28072/): WordPress pixfort Core plugin <= 3.2.22 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-28071](https://insights.sbomify.com/CVE-2026-28071/): WordPress pixfort Core plugin <= 3.2.22 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-28070](https://insights.sbomify.com/CVE-2026-28070/): WordPress WP eMember plugin <= v10.2.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-2807](https://insights.sbomify.com/CVE-2026-2807/): Memory safety bugs fixed in Firefox 148 and Thunderbird 148 (critical 9.8)
- [CVE-2026-28069](https://insights.sbomify.com/CVE-2026-28069/): WordPress Le Truffe theme <= 1.1.7 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28068](https://insights.sbomify.com/CVE-2026-28068/): WordPress Rhythmo theme <= 1.3.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28067](https://insights.sbomify.com/CVE-2026-28067/): WordPress Bassein theme <= 1.0.15 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28066](https://insights.sbomify.com/CVE-2026-28066/): WordPress Legrand theme <= 2.17 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28065](https://insights.sbomify.com/CVE-2026-28065/): WordPress Eject theme <= 2.17 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28064](https://insights.sbomify.com/CVE-2026-28064/): WordPress Edge Decor theme <= 2.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28063](https://insights.sbomify.com/CVE-2026-28063/): WordPress Asia Garden theme <= 1.3.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28062](https://insights.sbomify.com/CVE-2026-28062/): WordPress Happy Baby theme <= 1.2.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28061](https://insights.sbomify.com/CVE-2026-28061/): WordPress Tiger Claw theme <= 1.1.14 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28060](https://insights.sbomify.com/CVE-2026-28060/): WordPress S.King theme <= 1.5.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2806](https://insights.sbomify.com/CVE-2026-2806/): Uninitialized memory in the Graphics: Text component (critical 9.1)
- [CVE-2026-28059](https://insights.sbomify.com/CVE-2026-28059/): WordPress Dermatology Clinic theme <= 1.4.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28058](https://insights.sbomify.com/CVE-2026-28058/): WordPress Dixon theme <= 1.4.2.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28057](https://insights.sbomify.com/CVE-2026-28057/): WordPress Mandala theme <= 2.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28056](https://insights.sbomify.com/CVE-2026-28056/): WordPress MCKinney's Politics theme <= 1.2.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28055](https://insights.sbomify.com/CVE-2026-28055/): WordPress M.Williamson theme <= 1.2.11 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28054](https://insights.sbomify.com/CVE-2026-28054/): WordPress Legal Stone theme <= 1.2.11 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28053](https://insights.sbomify.com/CVE-2026-28053/): WordPress Miller theme <= 1.3.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28052](https://insights.sbomify.com/CVE-2026-28052/): WordPress Peter Mason theme <= 1.4.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28051](https://insights.sbomify.com/CVE-2026-28051/): WordPress Yacht Rental theme <= 2.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28050](https://insights.sbomify.com/CVE-2026-28050/): WordPress Beacon theme <= 2.24 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2805](https://insights.sbomify.com/CVE-2026-2805/): Invalid pointer in the DOM: Core & HTML component (critical 9.8)
- [CVE-2026-28049](https://insights.sbomify.com/CVE-2026-28049/): WordPress Police Department theme <= 2.17 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28048](https://insights.sbomify.com/CVE-2026-28048/): WordPress FlashMart theme <= 2.0.15 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28047](https://insights.sbomify.com/CVE-2026-28047/): WordPress Victo theme <= 1.4.16 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28046](https://insights.sbomify.com/CVE-2026-28046/): WordPress Law Office theme <= 3.3.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28045](https://insights.sbomify.com/CVE-2026-28045/): WordPress N7 | Golf Club Sports & Events theme <= 2.16.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28044](https://insights.sbomify.com/CVE-2026-28044/): WordPress WP Rocket plugin <= 3.19.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-28043](https://insights.sbomify.com/CVE-2026-28043/): WordPress Healer - Doctor, Clinic & Medical WordPress Theme theme <= 1.0.0 - Local File Inclusion vulnerability (critical 9.8)
- [CVE-2026-28042](https://insights.sbomify.com/CVE-2026-28042/): WordPress Listify plugin <= 3.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-28041](https://insights.sbomify.com/CVE-2026-28041/): WordPress Grit theme <= 1.0.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28040](https://insights.sbomify.com/CVE-2026-28040/): WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-2804](https://insights.sbomify.com/CVE-2026-2804/): Use-after-free in the JavaScript: WebAssembly component (medium 5.4)
- [CVE-2026-28039](https://insights.sbomify.com/CVE-2026-28039/): WordPress wpDataTables plugin <= 6.5.0.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-28038](https://insights.sbomify.com/CVE-2026-28038/): WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.21.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-28037](https://insights.sbomify.com/CVE-2026-28037/): WordPress EventON plugin <= 4.9.12 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-28036](https://insights.sbomify.com/CVE-2026-28036/): WordPress Ratatouille theme <= 1.2.6 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2026-28035](https://insights.sbomify.com/CVE-2026-28035/): WordPress Printy theme <= 1.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28034](https://insights.sbomify.com/CVE-2026-28034/): WordPress Progress theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28033](https://insights.sbomify.com/CVE-2026-28033/): WordPress Edifice theme <= 1.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28032](https://insights.sbomify.com/CVE-2026-28032/): WordPress Tuning theme <= 1.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28031](https://insights.sbomify.com/CVE-2026-28031/): WordPress Invetex theme <= 2.18 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28030](https://insights.sbomify.com/CVE-2026-28030/): WordPress Bonbon theme <= 1.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2803](https://insights.sbomify.com/CVE-2026-2803/): Information disclosure, mitigation bypass in the Settings UI component (high 7.5)
- [CVE-2026-28029](https://insights.sbomify.com/CVE-2026-28029/): WordPress EmojiNation theme <= 1.0.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28028](https://insights.sbomify.com/CVE-2026-28028/): WordPress MoneyFlow theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28027](https://insights.sbomify.com/CVE-2026-28027/): WordPress Kayon theme <= 1.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28026](https://insights.sbomify.com/CVE-2026-28026/): WordPress Motorix theme <= 1.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28025](https://insights.sbomify.com/CVE-2026-28025/): WordPress Stargaze theme <= 1.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28024](https://insights.sbomify.com/CVE-2026-28024/): WordPress Helion theme <= 1.1.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28023](https://insights.sbomify.com/CVE-2026-28023/): WordPress Nuts theme <= 1.10 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28022](https://insights.sbomify.com/CVE-2026-28022/): WordPress Foodie theme <= 1.14 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28021](https://insights.sbomify.com/CVE-2026-28021/): WordPress Craftis theme <= 1.2.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28020](https://insights.sbomify.com/CVE-2026-28020/): WordPress Chroma theme <= 1.11 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2802](https://insights.sbomify.com/CVE-2026-2802/): Race condition in the JavaScript: GC component (medium 4.2)
- [CVE-2026-28019](https://insights.sbomify.com/CVE-2026-28019/): WordPress Manoir theme <= 1.11 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28018](https://insights.sbomify.com/CVE-2026-28018/): WordPress Global Logistics theme <= 3.20 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28017](https://insights.sbomify.com/CVE-2026-28017/): WordPress Green Thumb theme <= 1.1.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28016](https://insights.sbomify.com/CVE-2026-28016/): WordPress Luxury Wine theme <= 1.1.14 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28015](https://insights.sbomify.com/CVE-2026-28015/): WordPress ShiftCV theme <= 3.0.14 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28014](https://insights.sbomify.com/CVE-2026-28014/): WordPress Translogic theme <= 1.2.11 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28013](https://insights.sbomify.com/CVE-2026-28013/): WordPress Kratz theme <= 1.0.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28012](https://insights.sbomify.com/CVE-2026-28012/): WordPress Gridiron theme <= 1.0.14 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28011](https://insights.sbomify.com/CVE-2026-28011/): WordPress Yottis theme <= 1.0.10 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28010](https://insights.sbomify.com/CVE-2026-28010/): WordPress Scientia theme <= 1.2.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2801](https://insights.sbomify.com/CVE-2026-2801/): Incorrect boundary conditions in the JavaScript: WebAssembly component (high 7.5)
- [CVE-2026-28009](https://insights.sbomify.com/CVE-2026-28009/): WordPress DroneX theme <= 1.1.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28008](https://insights.sbomify.com/CVE-2026-28008/): WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2026-28007](https://insights.sbomify.com/CVE-2026-28007/): WordPress Coinpress theme <= 1.0.14 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28006](https://insights.sbomify.com/CVE-2026-28006/): WordPress Yungen theme <= 1.0.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-28005](https://insights.sbomify.com/CVE-2026-28005/): WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-28004](https://insights.sbomify.com/CVE-2026-28004/): WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-28003](https://insights.sbomify.com/CVE-2026-28003/): WordPress Maspik – Spam blacklist plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-28002](https://insights.sbomify.com/CVE-2026-28002/): WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-28001](https://insights.sbomify.com/CVE-2026-28001/): WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-2800](https://insights.sbomify.com/CVE-2026-2800/): Spoofing issue in the WebAuthn component in Firefox for Android (critical 9.8)
- [CVE-2026-27999](https://insights.sbomify.com/CVE-2026-27999/): WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-27998](https://insights.sbomify.com/CVE-2026-27998/): WordPress Vixus theme <= 1.0.16 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27997](https://insights.sbomify.com/CVE-2026-27997/): WordPress Maxify theme <= 1.0.16 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27996](https://insights.sbomify.com/CVE-2026-27996/): WordPress Lingvico theme <= 1.0.14 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27995](https://insights.sbomify.com/CVE-2026-27995/): WordPress Justitia theme <= 1.1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27994](https://insights.sbomify.com/CVE-2026-27994/): WordPress Tediss theme <= 1.2.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27993](https://insights.sbomify.com/CVE-2026-27993/): WordPress Aldo theme <= 1.0.10 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27992](https://insights.sbomify.com/CVE-2026-27992/): WordPress Meals & Wheels theme <= 1.1.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27991](https://insights.sbomify.com/CVE-2026-27991/): WordPress Avventure theme <= 1.1.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27990](https://insights.sbomify.com/CVE-2026-27990/): WordPress ConFix theme <= 1.013 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2799](https://insights.sbomify.com/CVE-2026-2799/): Use-after-free in the DOM: Core & HTML component (high 8.8)
- [CVE-2026-27989](https://insights.sbomify.com/CVE-2026-27989/): WordPress Quanzo theme <= 1.0.10 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27988](https://insights.sbomify.com/CVE-2026-27988/): WordPress Equadio theme <= 1.1.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27987](https://insights.sbomify.com/CVE-2026-27987/): WordPress The Qlean theme <= 2.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27986](https://insights.sbomify.com/CVE-2026-27986/): WordPress OsTende theme <= 1.4.3 - Local File Inclusion vulnerability (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/749/