# Vulnerabilities published in 2026


- [CVE-2026-25461](https://insights.sbomify.com/CVE-2026-25461/): WordPress Listeo Core plugin <= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25460](https://insights.sbomify.com/CVE-2026-25460/): WordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-2546](https://insights.sbomify.com/CVE-2026-2546/): LigeroSmart index.pl cross site scripting (medium 5.1)
- [CVE-2026-25459](https://insights.sbomify.com/CVE-2026-25459/): WordPress Sober theme <= 3.5.12 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25458](https://insights.sbomify.com/CVE-2026-25458/): WordPress Moments theme <= 2.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-25457](https://insights.sbomify.com/CVE-2026-25457/): WordPress Mixtape theme <= 2.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-25456](https://insights.sbomify.com/CVE-2026-25456/): WordPress Automated FedEx live/manual rates with shipping labels plugin <= 5.1.9 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-25455](https://insights.sbomify.com/CVE-2026-25455/): WordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25454](https://insights.sbomify.com/CVE-2026-25454/): WordPress The League theme <= 4.4.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25453](https://insights.sbomify.com/CVE-2026-25453/): WordPress Advanced iFrame plugin <= 2025.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-25452](https://insights.sbomify.com/CVE-2026-25452/): WordPress Remoji plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25451](https://insights.sbomify.com/CVE-2026-25451/): WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-25450](https://insights.sbomify.com/CVE-2026-25450/): WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-2545](https://insights.sbomify.com/CVE-2026-2545/): LigeroSmart index.pl cross site scripting (medium 5.1)
- [CVE-2026-25449](https://insights.sbomify.com/CVE-2026-25449/): WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-25448](https://insights.sbomify.com/CVE-2026-25448/): WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25447](https://insights.sbomify.com/CVE-2026-25447/): WordPress Widget Wrangler plugin <= 2.3.9 - Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2026-25446](https://insights.sbomify.com/CVE-2026-25446/): WordPress WishList Member X plugin <= 3.29.0 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-25445](https://insights.sbomify.com/CVE-2026-25445/): WordPress WishList Member X plugin <= 3.29.0 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-25444](https://insights.sbomify.com/CVE-2026-25444/): WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25443](https://insights.sbomify.com/CVE-2026-25443/): WordPress Fraud Prevention For Woocommerce plugin <= 2.3.3 - Arbitrary Content Deletion vulnerability (high 7.5)
- [CVE-2026-25442](https://insights.sbomify.com/CVE-2026-25442/): WordPress Kentha theme <= 4.7.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25441](https://insights.sbomify.com/CVE-2026-25441/): WordPress LeadConnector plugin <= 3.0.21 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25440](https://insights.sbomify.com/CVE-2026-25440/): WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-2544](https://insights.sbomify.com/CVE-2026-2544/): yued-fe LuLu UI run.js child_process.exec os command injection (medium 6.9)
- [CVE-2026-25439](https://insights.sbomify.com/CVE-2026-25439/): WordPress Booknetic plugin < 5.10.3 - Broken Authentication vulnerability (high 8.1)
- [CVE-2026-25438](https://insights.sbomify.com/CVE-2026-25438/): Cross-site scripting in Gutenberg Blocks (high 7.1)
- [CVE-2026-25437](https://insights.sbomify.com/CVE-2026-25437/): WordPress GZSEO plugin <= 2.0.14 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25436](https://insights.sbomify.com/CVE-2026-25436/): WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25435](https://insights.sbomify.com/CVE-2026-25435/): WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25434](https://insights.sbomify.com/CVE-2026-25434/): WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-25433](https://insights.sbomify.com/CVE-2026-25433/): WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-25432](https://insights.sbomify.com/CVE-2026-25432/): WordPress Omnipress plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-25431](https://insights.sbomify.com/CVE-2026-25431/): WordPress Hustle plugin <= 7.8.10.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25430](https://insights.sbomify.com/CVE-2026-25430/): Missing authorization in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms (medium 6.5)
- [CVE-2026-2543](https://insights.sbomify.com/CVE-2026-2543/): vichan-devel vichan Password Change pages.php unverified password change (medium 5.1)
- [CVE-2026-25429](https://insights.sbomify.com/CVE-2026-25429/): WordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-25428](https://insights.sbomify.com/CVE-2026-25428/): WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4)
- [CVE-2026-25427](https://insights.sbomify.com/CVE-2026-25427/): WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-25426](https://insights.sbomify.com/CVE-2026-25426/): WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25425](https://insights.sbomify.com/CVE-2026-25425/): WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-25424](https://insights.sbomify.com/CVE-2026-25424/): WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25423](https://insights.sbomify.com/CVE-2026-25423/): WordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerability (low 3.8)
- [CVE-2026-25422](https://insights.sbomify.com/CVE-2026-25422/): WordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-25420](https://insights.sbomify.com/CVE-2026-25420/): WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-2542](https://insights.sbomify.com/CVE-2026-2542/): Total VPN win-service.exe unquoted search path (high 7.3)
- [CVE-2026-25419](https://insights.sbomify.com/CVE-2026-25419/): WordPress UpsellWP plugin <= 2.2.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25418](https://insights.sbomify.com/CVE-2026-25418/): WordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-25417](https://insights.sbomify.com/CVE-2026-25417/): WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-25416](https://insights.sbomify.com/CVE-2026-25416/): WordPress News Kit Elementor Addons plugin <= 1.4.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25415](https://insights.sbomify.com/CVE-2026-25415/): WordPress WPBookit Pro plugin <= 1.6.18 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25414](https://insights.sbomify.com/CVE-2026-25414/): WordPress WPBookit Pro plugin <= 1.6.18 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-25413](https://insights.sbomify.com/CVE-2026-25413/): WordPress WPBookit Pro plugin <= 1.6.18 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-25411](https://insights.sbomify.com/CVE-2026-25411/): WordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-25410](https://insights.sbomify.com/CVE-2026-25410/): WordPress WP-CORS plugin <= 0.2.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-2541](https://insights.sbomify.com/CVE-2026-2541/): Micca KE700 Brute-force vulnerability due to low entropy (medium 6.4)
- [CVE-2026-25409](https://insights.sbomify.com/CVE-2026-25409/): WordPress JAMstack Deployments plugin <= 1.1.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25408](https://insights.sbomify.com/CVE-2026-25408/): WordPress Broken Link Notifier plugin <= 1.3.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25407](https://insights.sbomify.com/CVE-2026-25407/): WordPress Cookiebot plugin <= 4.6.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25406](https://insights.sbomify.com/CVE-2026-25406/): WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability (high 8.1)
- [CVE-2026-25405](https://insights.sbomify.com/CVE-2026-25405/): WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-25404](https://insights.sbomify.com/CVE-2026-25404/): WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25403](https://insights.sbomify.com/CVE-2026-25403/): WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25402](https://insights.sbomify.com/CVE-2026-25402/): Missing authorization in Knowledge Base for Documentation, FAQs with AI Assistance (medium 4.3)
- [CVE-2026-25401](https://insights.sbomify.com/CVE-2026-25401/): WordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-25400](https://insights.sbomify.com/CVE-2026-25400/): WordPress Apicona theme <= 24.1.0 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-2540](https://insights.sbomify.com/CVE-2026-2540/): Micca KE700 Acceptance of previously used rolling codes (high 8.4)
- [CVE-2026-25399](https://insights.sbomify.com/CVE-2026-25399/): WordPress Serious Slider plugin <= 1.2.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25398](https://insights.sbomify.com/CVE-2026-25398/): WordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25397](https://insights.sbomify.com/CVE-2026-25397/): WordPress File Uploader for WooCommerce plugin <= 1.0.4 - Path Traversal vulnerability (high 7.5)
- [CVE-2026-25396](https://insights.sbomify.com/CVE-2026-25396/): WordPress Commerce Coinbase For WooCommerce plugin <= 1.6.6 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-25395](https://insights.sbomify.com/CVE-2026-25395/): WordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25394](https://insights.sbomify.com/CVE-2026-25394/): WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25393](https://insights.sbomify.com/CVE-2026-25393/): WordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25392](https://insights.sbomify.com/CVE-2026-25392/): Open redirect in Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress (medium 4.7)
- [CVE-2026-25391](https://insights.sbomify.com/CVE-2026-25391/): WordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-25390](https://insights.sbomify.com/CVE-2026-25390/): WordPress New User Approve plugin <= 3.2.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-2539](https://insights.sbomify.com/CVE-2026-2539/): Micca KE700 Cleartext transmission of key fob ID (medium 5.7)
- [CVE-2026-25389](https://insights.sbomify.com/CVE-2026-25389/): WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-25388](https://insights.sbomify.com/CVE-2026-25388/): WordPress Ads Pro plugin <= 5.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-25387](https://insights.sbomify.com/CVE-2026-25387/): WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25386](https://insights.sbomify.com/CVE-2026-25386/): WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25385](https://insights.sbomify.com/CVE-2026-25385/): WordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability (medium 5.5)
- [CVE-2026-25384](https://insights.sbomify.com/CVE-2026-25384/): WordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25383](https://insights.sbomify.com/CVE-2026-25383/): WordPress KiviCare plugin <= 3.6.16 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25382](https://insights.sbomify.com/CVE-2026-25382/): WordPress IdealAuto theme < 3.8.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-25381](https://insights.sbomify.com/CVE-2026-25381/): WordPress LoveDate theme < 3.8.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-25380](https://insights.sbomify.com/CVE-2026-25380/): WordPress Feedy theme < 2.1.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2538](https://insights.sbomify.com/CVE-2026-2538/): Flos Freeware Notepad2 Msimg32.dll uncontrolled search path (high 7.3)
- [CVE-2026-25379](https://insights.sbomify.com/CVE-2026-25379/): WordPress StreamVid theme < 6.8.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-25378](https://insights.sbomify.com/CVE-2026-25378/): WordPress Nelio AB Testing plugin <= 8.2.4 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-25377](https://insights.sbomify.com/CVE-2026-25377/): WordPress Addon Jobsearch Chat plugin <= 3.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-25376](https://insights.sbomify.com/CVE-2026-25376/): WordPress Addon Jobsearch Chat plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25375](https://insights.sbomify.com/CVE-2026-25375/): WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25374](https://insights.sbomify.com/CVE-2026-25374/): WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25373](https://insights.sbomify.com/CVE-2026-25373/): Cross-site scripting in Vayvo (high 7.1)
- [CVE-2026-25372](https://insights.sbomify.com/CVE-2026-25372/): WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25371](https://insights.sbomify.com/CVE-2026-25371/): WordPress Lumise Product Designer plugin < 2.0.9 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-25370](https://insights.sbomify.com/CVE-2026-25370/): WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-2537](https://insights.sbomify.com/CVE-2026-2537/): Comfast CF-E4 HTTP POST Request mbox-config command injection (medium 5.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/770/