# Vulnerabilities published in 2026


- [CVE-2026-25043](https://insights.sbomify.com/CVE-2026-25043/): Budibase: Unauthenticated Password Reset Endpoint Lacks Rate Limiting, Enabling Email Flooding (medium 5.3)
- [CVE-2026-25041](https://insights.sbomify.com/CVE-2026-25041/): Budibase has a Command Injection in PostgreSQL Dump Command (high 8.6)
- [CVE-2026-25040](https://insights.sbomify.com/CVE-2026-25040/): Budibase Vulnerable to Privilege Escalation via API Abuse – Creator Can Invite Users with Admin/Any Role (medium 5.7)
- [CVE-2026-2504](https://insights.sbomify.com/CVE-2026-2504/): Dealia – Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset (medium 4.3)
- [CVE-2026-25039](https://insights.sbomify.com/CVE-2026-25039/): The application evaluate UNC path in workspace name (high 8.8)
- [CVE-2026-25038](https://insights.sbomify.com/CVE-2026-25038/): Gitea private organization labels are visible to unauthorized users (high 7.5)
- [CVE-2026-25037](https://insights.sbomify.com/CVE-2026-25037/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0)
- [CVE-2026-25036](https://insights.sbomify.com/CVE-2026-25036/): WordPress Passster plugin <= 4.2.25 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25035](https://insights.sbomify.com/CVE-2026-25035/): WordPress Contest Gallery plugin <= 28.1.2.2 - Account Takeover vulnerability (critical 9.8)
- [CVE-2026-25034](https://insights.sbomify.com/CVE-2026-25034/): WordPress KiviCare plugin <= 3.6.16 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25033](https://insights.sbomify.com/CVE-2026-25033/): WordPress Motta Addons plugin < 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25032](https://insights.sbomify.com/CVE-2026-25032/): WordPress Ricky theme < 2.31 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-25031](https://insights.sbomify.com/CVE-2026-25031/): WordPress Tasty Daily theme < 1.27 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-25030](https://insights.sbomify.com/CVE-2026-25030/): WordPress Goldish theme < 3.47 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-2503](https://insights.sbomify.com/CVE-2026-2503/): ElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter (medium 6.5)
- [CVE-2026-25029](https://insights.sbomify.com/CVE-2026-25029/): WordPress KIDZ theme <= 5.24 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-25028](https://insights.sbomify.com/CVE-2026-25028/): WordPress ElementInvader Addons for Elementor plugin <= 1.4.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-25027](https://insights.sbomify.com/CVE-2026-25027/): WordPress Unicamp theme <= 2.7.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-25026](https://insights.sbomify.com/CVE-2026-25026/): WordPress Team plugin <= 5.0.11 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-25025](https://insights.sbomify.com/CVE-2026-25025/): WordPress VikRestaurants plugin <= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25024](https://insights.sbomify.com/CVE-2026-25024/): WordPress ThirstyAffiliates plugin <= 3.11.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-25023](https://insights.sbomify.com/CVE-2026-25023/): WordPress Run Contests, Raffles, and Giveaways with ContestsWP plugin <= 2.0.7 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-25022](https://insights.sbomify.com/CVE-2026-25022/): WordPress KiviCare plugin <= 3.6.16 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-25021](https://insights.sbomify.com/CVE-2026-25021/): WordPress Mizan Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-25020](https://insights.sbomify.com/CVE-2026-25020/): WordPress WP Sync for Notion plugin <= 1.7.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-2502](https://insights.sbomify.com/CVE-2026-2502/): xmlrpc attacks blocker <= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' (medium 6.1)
- [CVE-2026-25019](https://insights.sbomify.com/CVE-2026-25019/): WordPress Atarim plugin <= 4.3.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25018](https://insights.sbomify.com/CVE-2026-25018/): WordPress NaturaLife Extensions plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25017](https://insights.sbomify.com/CVE-2026-25017/): WordPress NaturaLife Extensions plugin <= 2.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-25016](https://insights.sbomify.com/CVE-2026-25016/): WordPress Nelio Popups plugin <= 1.3.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25015](https://insights.sbomify.com/CVE-2026-25015/): WordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-25014](https://insights.sbomify.com/CVE-2026-25014/): WordPress Enter Addons plugin <= 2.3.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-25013](https://insights.sbomify.com/CVE-2026-25013/): WordPress Phox Hosting plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-25012](https://insights.sbomify.com/CVE-2026-25012/): WordPress WP Bannerize Pro plugin <= 1.11.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25011](https://insights.sbomify.com/CVE-2026-25011/): WordPress WP Custom Admin Interface plugin <= 7.41 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25010](https://insights.sbomify.com/CVE-2026-25010/): WordPress Share This Image plugin <= 2.09 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-2501](https://insights.sbomify.com/CVE-2026-2501/): Ed's Social Share <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-25009](https://insights.sbomify.com/CVE-2026-25009/): WordPress Education Zone theme <= 1.3.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-25008](https://insights.sbomify.com/CVE-2026-25008/): WordPress Ninja Tables plugin <= 5.2.5 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-25007](https://insights.sbomify.com/CVE-2026-25007/): WordPress ElementInvader Addons for Elementor plugin <= 1.4.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-25006](https://insights.sbomify.com/CVE-2026-25006/): WordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-25005](https://insights.sbomify.com/CVE-2026-25005/): WordPress Frontend File Manager plugin <= 23.5 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-25004](https://insights.sbomify.com/CVE-2026-25004/): WordPress CM Business Directory plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-25003](https://insights.sbomify.com/CVE-2026-25003/): WordPress Client Portal plugin <= 1.2.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-25002](https://insights.sbomify.com/CVE-2026-25002/): WordPress LearnPress – Sepay Payment plugin <= 4.0.0 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-25001](https://insights.sbomify.com/CVE-2026-25001/): WordPress Post Snippets plugin <= 4.0.12 - Remote Code Execution (RCE) vulnerability (high 8.5)
- [CVE-2026-25000](https://insights.sbomify.com/CVE-2026-25000/): WordPress Wheel of Life plugin <= 1.2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-2500](https://insights.sbomify.com/CVE-2026-2500/): Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter (medium 4.4)
- [CVE-2026-24999](https://insights.sbomify.com/CVE-2026-24999/): WordPress Alma plugin <= 5.16.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24998](https://insights.sbomify.com/CVE-2026-24998/): WordPress Hustle plugin <= 7.8.9.2 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-24997](https://insights.sbomify.com/CVE-2026-24997/): WordPress Wired Impact Volunteer Management plugin <= 2.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24996](https://insights.sbomify.com/CVE-2026-24996/): WordPress WPElemento Importer plugin <= 0.6.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24995](https://insights.sbomify.com/CVE-2026-24995/): WordPress Latest Post Shortcode plugin <= 14.2.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24994](https://insights.sbomify.com/CVE-2026-24994/): WordPress Sunshine Photo Cart plugin <= 3.5.7.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24993](https://insights.sbomify.com/CVE-2026-24993/): WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-24992](https://insights.sbomify.com/CVE-2026-24992/): WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.2 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-24991](https://insights.sbomify.com/CVE-2026-24991/): WordPress Extensions For CF7 plugin <= 3.4.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-24990](https://insights.sbomify.com/CVE-2026-24990/): WordPress WP Docs plugin <= 2.2.8 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-2499](https://insights.sbomify.com/CVE-2026-2499/): Custom Logo <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Logo Path Setting (medium 4.4)
- [CVE-2026-24989](https://insights.sbomify.com/CVE-2026-24989/): WordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-24988](https://insights.sbomify.com/CVE-2026-24988/): WordPress The Events Calendar Shortcode & Block plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24987](https://insights.sbomify.com/CVE-2026-24987/): WordPress WP System Log plugin <= 1.2.7 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-24986](https://insights.sbomify.com/CVE-2026-24986/): WordPress Simple Membership WP user Import plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-24985](https://insights.sbomify.com/CVE-2026-24985/): WordPress WP Forms Signature Contract Add-On plugin <= 1.8.2 - Broken Access Control to Notice Dismissal vulnerability (medium 4.3)
- [CVE-2026-24984](https://insights.sbomify.com/CVE-2026-24984/): WordPress Visual Link Preview plugin <= 2.2.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-24983](https://insights.sbomify.com/CVE-2026-24983/): WordPress UpSolution Core plugin <= 8.41 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-24982](https://insights.sbomify.com/CVE-2026-24982/): WordPress Spectra plugin <= 2.19.17 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24981](https://insights.sbomify.com/CVE-2026-24981/): WordPress Visionary Core plugin <= 1.4.9 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-24980](https://insights.sbomify.com/CVE-2026-24980/): WordPress Visionary Core plugin <= 1.4.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-2498](https://insights.sbomify.com/CVE-2026-2498/): WP Social Meta <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings (medium 4.4)
- [CVE-2026-24979](https://insights.sbomify.com/CVE-2026-24979/): WordPress Jobica Core plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-24978](https://insights.sbomify.com/CVE-2026-24978/): WordPress Jobica Core plugin <= 1.4.1 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-24977](https://insights.sbomify.com/CVE-2026-24977/): WordPress Organici Library plugin <= 2.1.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-24976](https://insights.sbomify.com/CVE-2026-24976/): WordPress Organici Library plugin <= 2.1.2 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-24975](https://insights.sbomify.com/CVE-2026-24975/): WordPress Organici Library plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-24974](https://insights.sbomify.com/CVE-2026-24974/): WordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-24973](https://insights.sbomify.com/CVE-2026-24973/): WordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-24972](https://insights.sbomify.com/CVE-2026-24972/): WordPress Elated Listing plugin <= 1.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-24971](https://insights.sbomify.com/CVE-2026-24971/): WordPress Search & Go theme <= 2.8 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-24970](https://insights.sbomify.com/CVE-2026-24970/): WordPress Energox theme <= 1.2 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2026-2497](https://insights.sbomify.com/CVE-2026-2497/): Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys (high 7.2)
- [CVE-2026-24969](https://insights.sbomify.com/CVE-2026-24969/): WordPress Instant VA theme <= 1.0.1 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2026-24968](https://insights.sbomify.com/CVE-2026-24968/): WordPress Xagio SEO plugin <= 7.1.0.30 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-24967](https://insights.sbomify.com/CVE-2026-24967/): WordPress Amelia plugin <= 1.2.38 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24966](https://insights.sbomify.com/CVE-2026-24966/): WordPress Copyscape Premium plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-24965](https://insights.sbomify.com/CVE-2026-24965/): WordPress Contest Gallery plugin <= 28.1.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24964](https://insights.sbomify.com/CVE-2026-24964/): WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2026-24963](https://insights.sbomify.com/CVE-2026-24963/): WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-24962](https://insights.sbomify.com/CVE-2026-24962/): WordPress Sigmize plugin <= 0.0.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-24961](https://insights.sbomify.com/CVE-2026-24961/): WordPress Grand Blog theme < 3.1.5 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2026-24960](https://insights.sbomify.com/CVE-2026-24960/): WordPress Charety theme < 2.0.2 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-2496](https://insights.sbomify.com/CVE-2026-2496/): Ed's Font Awesome <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-24959](https://insights.sbomify.com/CVE-2026-24959/): WordPress JS Help Desk plugin <= 3.0.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-24958](https://insights.sbomify.com/CVE-2026-24958/): WordPress JetElements For Elementor plugin <= 2.7.12.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24957](https://insights.sbomify.com/CVE-2026-24957/): WordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-24956](https://insights.sbomify.com/CVE-2026-24956/): WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-24955](https://insights.sbomify.com/CVE-2026-24955/): WordPress Whizz Plugins plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-24954](https://insights.sbomify.com/CVE-2026-24954/): WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability (high 8.8)
- [CVE-2026-24953](https://insights.sbomify.com/CVE-2026-24953/): WordPress Simple File List plugin <= 6.1.15 - Arbitrary File Download vulnerability (medium 6.5)
- [CVE-2026-24952](https://insights.sbomify.com/CVE-2026-24952/): WordPress Seriously Simple Podcasting plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/774/