# Vulnerabilities published in 2026


- [CVE-2026-25369](https://insights.sbomify.com/CVE-2026-25369/): WordPress Flexmls® IDX plugin <= 3.15.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25368](https://insights.sbomify.com/CVE-2026-25368/): WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25367](https://insights.sbomify.com/CVE-2026-25367/): WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25366](https://insights.sbomify.com/CVE-2026-25366/): WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-25365](https://insights.sbomify.com/CVE-2026-25365/): WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25364](https://insights.sbomify.com/CVE-2026-25364/): WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25363](https://insights.sbomify.com/CVE-2026-25363/): WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25362](https://insights.sbomify.com/CVE-2026-25362/): WordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-25361](https://insights.sbomify.com/CVE-2026-25361/): WordPress WpEvently plugin <= 5.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25360](https://insights.sbomify.com/CVE-2026-25360/): WordPress Vex theme < 1.2.9 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-2536](https://insights.sbomify.com/CVE-2026-2536/): opencc JFlow Workflow WF_Admin_AttrFlow.java Imp_Done xml external entity reference (medium 5.3)
- [CVE-2026-25359](https://insights.sbomify.com/CVE-2026-25359/): WordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-25358](https://insights.sbomify.com/CVE-2026-25358/): WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-25357](https://insights.sbomify.com/CVE-2026-25357/): WordPress Ultimate Membership Pro plugin <= 13.7 - Account Takeover vulnerability (high 8.1)
- [CVE-2026-25356](https://insights.sbomify.com/CVE-2026-25356/): WordPress Yobazar theme < 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25355](https://insights.sbomify.com/CVE-2026-25355/): WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-25354](https://insights.sbomify.com/CVE-2026-25354/): WordPress Reebox theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25353](https://insights.sbomify.com/CVE-2026-25353/): WordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25352](https://insights.sbomify.com/CVE-2026-25352/): WordPress MyDecor theme < 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25351](https://insights.sbomify.com/CVE-2026-25351/): WordPress MyMedi theme < 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25350](https://insights.sbomify.com/CVE-2026-25350/): WordPress Miti theme < 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-2535](https://insights.sbomify.com/CVE-2026-2535/): Comfast CF-N1 V2 mbox-config sub_44AB9C command injection (medium 5.3)
- [CVE-2026-25349](https://insights.sbomify.com/CVE-2026-25349/): WordPress Loobek theme < 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25348](https://insights.sbomify.com/CVE-2026-25348/): WordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25347](https://insights.sbomify.com/CVE-2026-25347/): WordPress WP REST Cache plugin <= 2026.1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25346](https://insights.sbomify.com/CVE-2026-25346/): WordPress FAQ Builder AYS plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25345](https://insights.sbomify.com/CVE-2026-25345/): WordPress SimpLy Gallery plugin <= 3.3.2 - Arbitrary Code Execution vulnerability (critical 9.9)
- [CVE-2026-25344](https://insights.sbomify.com/CVE-2026-25344/): WordPress Review Schema plugin <= 2.2.6 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-25343](https://insights.sbomify.com/CVE-2026-25343/): WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-25342](https://insights.sbomify.com/CVE-2026-25342/): WordPress Boutique theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25341](https://insights.sbomify.com/CVE-2026-25341/): WordPress RSFirewall! plugin <= 1.1.45 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25340](https://insights.sbomify.com/CVE-2026-25340/): WordPress Jobmonster theme < 4.8.4 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-2534](https://insights.sbomify.com/CVE-2026-2534/): Comfast CF-N1 V2 mbox-config sub_44AC4C command injection (medium 5.3)
- [CVE-2026-25339](https://insights.sbomify.com/CVE-2026-25339/): WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-25338](https://insights.sbomify.com/CVE-2026-25338/): WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.7.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25337](https://insights.sbomify.com/CVE-2026-25337/): WordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-25336](https://insights.sbomify.com/CVE-2026-25336/): WordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25335](https://insights.sbomify.com/CVE-2026-25335/): WordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25334](https://insights.sbomify.com/CVE-2026-25334/): WordPress Salon Booking System Pro plugin < 10.30.12 - Account Takeover vulnerability (high 8.1)
- [CVE-2026-25333](https://insights.sbomify.com/CVE-2026-25333/): WordPress Shopwell theme <= 1.0.11 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25332](https://insights.sbomify.com/CVE-2026-25332/): WordPress Endless Posts Navigation plugin <= 2.2.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25331](https://insights.sbomify.com/CVE-2026-25331/): WordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-25330](https://insights.sbomify.com/CVE-2026-25330/): WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-2533](https://insights.sbomify.com/CVE-2026-2533/): Tosei Self-service Washing Machine tosei_datasend.php command injection (medium 6.9)
- [CVE-2026-25329](https://insights.sbomify.com/CVE-2026-25329/): WordPress Quiz And Survey Master plugin <= 10.3.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25328](https://insights.sbomify.com/CVE-2026-25328/): WordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerability (medium 6.8)
- [CVE-2026-25327](https://insights.sbomify.com/CVE-2026-25327/): WordPress Five Star Restaurant Reservations plugin <= 2.7.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25326](https://insights.sbomify.com/CVE-2026-25326/): WordPress CMSMasters Content Composer plugin <= 1.4.5 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-25325](https://insights.sbomify.com/CVE-2026-25325/): WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.8 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-25324](https://insights.sbomify.com/CVE-2026-25324/): WordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-25323](https://insights.sbomify.com/CVE-2026-25323/): WordPress OSM plugin <= 6.1.12 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25322](https://insights.sbomify.com/CVE-2026-25322/): WordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-25321](https://insights.sbomify.com/CVE-2026-25321/): WordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25320](https://insights.sbomify.com/CVE-2026-25320/): WordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-2532](https://insights.sbomify.com/CVE-2026-2532/): lintsinghua DeepAudit IP Address embedding_config.py server-side request forgery (medium 5.3)
- [CVE-2026-25319](https://insights.sbomify.com/CVE-2026-25319/): WordPress Zita Elementor Site Library plugin <= 1.6.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-25318](https://insights.sbomify.com/CVE-2026-25318/): WordPress WiserReview Product Reviews for WooCommerce plugin <= 2.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25317](https://insights.sbomify.com/CVE-2026-25317/): WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.9.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-25316](https://insights.sbomify.com/CVE-2026-25316/): WordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-25315](https://insights.sbomify.com/CVE-2026-25315/): WordPress hCaptcha for WP plugin <= 4.21.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25314](https://insights.sbomify.com/CVE-2026-25314/): WordPress TOP Table Of Contents plugin <= 1.3.31 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25313](https://insights.sbomify.com/CVE-2026-25313/): WordPress FluentForm plugin <= 6.1.14 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25312](https://insights.sbomify.com/CVE-2026-25312/): WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability (high 7.5)
- [CVE-2026-25311](https://insights.sbomify.com/CVE-2026-25311/): WordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-25310](https://insights.sbomify.com/CVE-2026-25310/): WordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2026-2531](https://insights.sbomify.com/CVE-2026-2531/): MindsDB File Upload security.py clear_filename server-side request forgery (medium 5.3)
- [CVE-2026-25309](https://insights.sbomify.com/CVE-2026-25309/): WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-25308](https://insights.sbomify.com/CVE-2026-25308/): WordPress Simple Membership plugin <= 4.6.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25307](https://insights.sbomify.com/CVE-2026-25307/): WordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-25306](https://insights.sbomify.com/CVE-2026-25306/): WordPress XStore Core plugin <= 5.6.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25305](https://insights.sbomify.com/CVE-2026-25305/): WordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-25304](https://insights.sbomify.com/CVE-2026-25304/): WordPress Jaroti theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25302](https://insights.sbomify.com/CVE-2026-25302/): Improper Verification of Cryptographic Signature in Boot (high 7.1)
- [CVE-2026-2530](https://insights.sbomify.com/CVE-2026-2530/): Wavlink WL-WN579A3 wireless.cgi AddMac command injection (medium 5.3)
- [CVE-2026-25294](https://insights.sbomify.com/CVE-2026-25294/): Buffer Over-read in WLAN Firmware (high 7.4)
- [CVE-2026-25293](https://insights.sbomify.com/CVE-2026-25293/): Incorrect authorization in PLC FW (critical 9.6)
- [CVE-2026-25292](https://insights.sbomify.com/CVE-2026-25292/): Improper Validation of Syntactic Correctness of Input in Automotive Linux OS (high 7.6)
- [CVE-2026-25291](https://insights.sbomify.com/CVE-2026-25291/): Use After Free in Graphics (high 7.8)
- [CVE-2026-25290](https://insights.sbomify.com/CVE-2026-25290/): Integer Overflow or Wraparound in OOBM (high 7.8)
- [CVE-2026-2529](https://insights.sbomify.com/CVE-2026-2529/): Wavlink WL-WN579A3 wireless.cgi DeleteMac command injection (medium 5.3)
- [CVE-2026-25289](https://insights.sbomify.com/CVE-2026-25289/): Stack-based Buffer Overflow in WLAN Firmware (critical 9.6)
- [CVE-2026-25288](https://insights.sbomify.com/CVE-2026-25288/): Buffer Over-read in WLAN Firmware (high 7.4)
- [CVE-2026-25284](https://insights.sbomify.com/CVE-2026-25284/): Buffer Over-read in OOBM (high 7.3)
- [CVE-2026-25283](https://insights.sbomify.com/CVE-2026-25283/): Stack-based Buffer Overflow in OOBM (high 8.8)
- [CVE-2026-25282](https://insights.sbomify.com/CVE-2026-25282/): Out-of-bounds Read in OOBM (high 7.9)
- [CVE-2026-25281](https://insights.sbomify.com/CVE-2026-25281/): Allocation of Resources Without Limits or Throttling in OOBM (high 7.4)
- [CVE-2026-25280](https://insights.sbomify.com/CVE-2026-25280/): Out-of-bounds Write in DSP Service (high 7.8)
- [CVE-2026-2528](https://insights.sbomify.com/CVE-2026-2528/): Wavlink WL-WN579A3 wireless.cgi Delete_Mac_list command injection (medium 5.3)
- [CVE-2026-25278](https://insights.sbomify.com/CVE-2026-25278/): Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX (high 7.8)
- [CVE-2026-25277](https://insights.sbomify.com/CVE-2026-25277/): Buffer Copy Without Checking Size of Input in Secure Processor (high 8.8)
- [CVE-2026-25276](https://insights.sbomify.com/CVE-2026-25276/): Improper Validation of Array Index in Secure Processor (high 8.8)
- [CVE-2026-25275](https://insights.sbomify.com/CVE-2026-25275/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2026-25274](https://insights.sbomify.com/CVE-2026-25274/): Use After Free in Windows WLAN Host (medium 6.7)
- [CVE-2026-25273](https://insights.sbomify.com/CVE-2026-25273/): Out-of-bounds Write in Camera Driver (medium 6.7)
- [CVE-2026-25272](https://insights.sbomify.com/CVE-2026-25272/): Out-of-bounds Write in Camera Driver (medium 6.7)
- [CVE-2026-25271](https://insights.sbomify.com/CVE-2026-25271/): Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service (high 7.8)
- [CVE-2026-25270](https://insights.sbomify.com/CVE-2026-25270/): Out-of-bounds Write in Camera Driver (medium 6.7)
- [CVE-2026-2527](https://insights.sbomify.com/CVE-2026-2527/): Wavlink WL-WN579A3 login.cgi command injection (medium 5.3)
- [CVE-2026-25269](https://insights.sbomify.com/CVE-2026-25269/): Out-of-bounds Write in Camera Driver (medium 6.7)
- [CVE-2026-25268](https://insights.sbomify.com/CVE-2026-25268/): Stack-based Buffer Overflow in WLAN Host (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/771/