Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 770 of 1013.
- CVE-2026-25461 WordPress Listeo Core plugin <= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25460 WordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerability
- CVE-2026-2546 LigeroSmart index.pl cross site scripting
- CVE-2026-25459 WordPress Sober theme <= 3.5.12 - Broken Access Control vulnerability
- CVE-2026-25458 WordPress Moments theme <= 2.2 - Local File Inclusion vulnerability
- CVE-2026-25457 WordPress Mixtape theme <= 2.1 - Local File Inclusion vulnerability
- CVE-2026-25456 WordPress Automated FedEx live/manual rates with shipping labels plugin <= 5.1.9 - Broken Access Control vulnerability
- CVE-2026-25455 WordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerability
- CVE-2026-25454 WordPress The League theme <= 4.4.1 - Broken Access Control vulnerability
- CVE-2026-25453 WordPress Advanced iFrame plugin <= 2025.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25452 WordPress Remoji plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25451 WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25450 WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability
- CVE-2026-2545 LigeroSmart index.pl cross site scripting
- CVE-2026-25449 WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability
- CVE-2026-25448 WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability
- CVE-2026-25447 WordPress Widget Wrangler plugin <= 2.3.9 - Remote Code Execution (RCE) vulnerability
- CVE-2026-25446 WordPress WishList Member X plugin <= 3.29.0 - Arbitrary File Upload vulnerability
- CVE-2026-25445 WordPress WishList Member X plugin <= 3.29.0 - PHP Object Injection vulnerability
- CVE-2026-25444 WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability
- CVE-2026-25443 WordPress Fraud Prevention For Woocommerce plugin <= 2.3.3 - Arbitrary Content Deletion vulnerability
- CVE-2026-25442 WordPress Kentha theme <= 4.7.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25441 WordPress LeadConnector plugin <= 3.0.21 - Broken Access Control vulnerability
- CVE-2026-25440 WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability
- CVE-2026-2544 yued-fe LuLu UI run.js child_process.exec os command injection
- CVE-2026-25439 WordPress Booknetic plugin < 5.10.3 - Broken Authentication vulnerability
- CVE-2026-25438 Cross-site scripting in Gutenberg Blocks
- CVE-2026-25437 WordPress GZSEO plugin <= 2.0.14 - Broken Access Control vulnerability
- CVE-2026-25436 WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability
- CVE-2026-25435 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25434 WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability
- CVE-2026-25433 WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability
- CVE-2026-25432 WordPress Omnipress plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25431 WordPress Hustle plugin <= 7.8.10.1 - Broken Access Control vulnerability
- CVE-2026-25430 Missing authorization in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
- CVE-2026-2543 vichan-devel vichan Password Change pages.php unverified password change
- CVE-2026-25429 WordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerability
- CVE-2026-25428 WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-25427 WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability
- CVE-2026-25426 WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability
- CVE-2026-25425 WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability
- CVE-2026-25424 WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability
- CVE-2026-25423 WordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerability
- CVE-2026-25422 WordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-25420 WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability
- CVE-2026-2542 Total VPN win-service.exe unquoted search path
- CVE-2026-25419 WordPress UpsellWP plugin <= 2.2.5 - Broken Access Control vulnerability
- CVE-2026-25418 WordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerability
- CVE-2026-25417 WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25416 WordPress News Kit Elementor Addons plugin <= 1.4.2 - Broken Access Control vulnerability
- CVE-2026-25415 WordPress WPBookit Pro plugin <= 1.6.18 - Broken Access Control vulnerability
- CVE-2026-25414 WordPress WPBookit Pro plugin <= 1.6.18 - Privilege Escalation vulnerability
- CVE-2026-25413 WordPress WPBookit Pro plugin <= 1.6.18 - Arbitrary File Upload vulnerability
- CVE-2026-25411 WordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-25410 WordPress WP-CORS plugin <= 0.2.2 - Broken Access Control vulnerability
- CVE-2026-2541 Micca KE700 Brute-force vulnerability due to low entropy
- CVE-2026-25409 WordPress JAMstack Deployments plugin <= 1.1.1 - Broken Access Control vulnerability
- CVE-2026-25408 WordPress Broken Link Notifier plugin <= 1.3.5 - Broken Access Control vulnerability
- CVE-2026-25407 WordPress Cookiebot plugin <= 4.6.4 - Broken Access Control vulnerability
- CVE-2026-25406 WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability
- CVE-2026-25405 WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability
- CVE-2026-25404 WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability
- CVE-2026-25403 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability
- CVE-2026-25402 Missing authorization in Knowledge Base for Documentation, FAQs with AI Assistance
- CVE-2026-25401 WordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerability
- CVE-2026-25400 WordPress Apicona theme <= 24.1.0 - PHP Object Injection vulnerability
- CVE-2026-2540 Micca KE700 Acceptance of previously used rolling codes
- CVE-2026-25399 WordPress Serious Slider plugin <= 1.2.7 - Broken Access Control vulnerability
- CVE-2026-25398 WordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerability
- CVE-2026-25397 WordPress File Uploader for WooCommerce plugin <= 1.0.4 - Path Traversal vulnerability
- CVE-2026-25396 WordPress Commerce Coinbase For WooCommerce plugin <= 1.6.6 - Broken Access Control vulnerability
- CVE-2026-25395 WordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerability
- CVE-2026-25394 WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability
- CVE-2026-25393 WordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerability
- CVE-2026-25392 Open redirect in Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress
- CVE-2026-25391 WordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerability
- CVE-2026-25390 WordPress New User Approve plugin <= 3.2.3 - Broken Access Control vulnerability
- CVE-2026-2539 Micca KE700 Cleartext transmission of key fob ID
- CVE-2026-25389 WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability
- CVE-2026-25388 WordPress Ads Pro plugin <= 5.0 - Broken Access Control vulnerability
- CVE-2026-25387 WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability
- CVE-2026-25386 WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability
- CVE-2026-25385 WordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-25384 WordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerability
- CVE-2026-25383 WordPress KiviCare plugin <= 3.6.16 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25382 WordPress IdealAuto theme < 3.8.6 - Local File Inclusion vulnerability
- CVE-2026-25381 WordPress LoveDate theme < 3.8.6 - Local File Inclusion vulnerability
- CVE-2026-25380 WordPress Feedy theme < 2.1.5 - Local File Inclusion vulnerability
- CVE-2026-2538 Flos Freeware Notepad2 Msimg32.dll uncontrolled search path
- CVE-2026-25379 WordPress StreamVid theme < 6.8.6 - Local File Inclusion vulnerability
- CVE-2026-25378 WordPress Nelio AB Testing plugin <= 8.2.4 - SQL Injection vulnerability
- CVE-2026-25377 WordPress Addon Jobsearch Chat plugin <= 3.0 - SQL Injection vulnerability
- CVE-2026-25376 WordPress Addon Jobsearch Chat plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25375 WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability
- CVE-2026-25374 WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability
- CVE-2026-25373 Cross-site scripting in Vayvo
- CVE-2026-25372 WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability
- CVE-2026-25371 WordPress Lumise Product Designer plugin < 2.0.9 - SQL Injection vulnerability
- CVE-2026-25370 WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability
- CVE-2026-2537 Comfast CF-E4 HTTP POST Request mbox-config command injection