Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 778 of 1013.
- CVE-2026-24632 WordPress Delay Redirects plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24631 WordPress Rosebud theme <= 1.4 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-24630 WordPress Stylish Cost Calculator plugin <= 8.2.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2463 Unauthorized access to invite ID during team creation
- CVE-2026-24629 WordPress Web Accessibility with Max Access plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24628 WordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24627 WordPress Trusona for WordPress plugin <= 2.0.0 - Broken Access Control vulnerability
- CVE-2026-24626 WordPress Logo Slider plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24625 WordPress File Uploads Addon for WooCommerce plugin <= 1.7.3 - Broken Access Control vulnerability
- CVE-2026-24624 WordPress Neoforum plugin <= 1.0 - SQL Injection vulnerability
- CVE-2026-24623 WordPress Neoforum plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-24622 WordPress Suggestion Toolkit plugin <= 5.0 - Broken Access Control vulnerability
- CVE-2026-24621 WordPress Terms descriptions plugin <= 3.4.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24620 WordPress Landing Page Builder plugin <= 1.5.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2462 Admin RCE via Malicious Plugin Upload on CI Test Instances
- CVE-2026-24619 WordPress PopCash.Net Code Integration Tool plugin <= 1.8 - Broken Access Control vulnerability
- CVE-2026-24618 WordPress Hash Elements plugin <= 1.5.4 - Sensitive Data Exposure vulnerability
- CVE-2026-24617 WordPress Easy Modal plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24616 WordPress WP Popups plugin <= 2.2.0.5 - Broken Access Control vulnerability
- CVE-2026-24615 WordPress Cream Magazine theme <= 2.1.10 - Broken Access Control vulnerability
- CVE-2026-24614 WordPress Flex QR Code Generator plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24613 WordPress Ecwid Shopping Cart plugin <= 7.0.6 - Broken Access Control vulnerability
- CVE-2026-24612 WordPress Orchid Store theme <= 1.5.15 - Broken Access Control vulnerability
- CVE-2026-24611 WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability
- CVE-2026-24610 WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability
- CVE-2026-2461 Missing authorization check allows unauthorized modification of other users' comments on a board
- CVE-2026-24609 WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability
- CVE-2026-24608 WordPress Laurent Core plugin <= 2.4.1 - Local File Inclusion vulnerability
- CVE-2026-24607 WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerability
- CVE-2026-24606 WordPress Bayarcash WooCommerce plugin <= 4.3.13 - Broken Access Control vulnerability
- CVE-2026-24605 WordPress X Addons for Elementor plugin <= 1.0.23 - Broken Access Control vulnerability
- CVE-2026-24604 WordPress Simple GDPR Cookie Compliance plugin <= 2.0.0 - Broken Access Control vulnerability
- CVE-2026-24603 WordPress Universal Google Adsense and Ads manager plugin <= 1.1.8 - Broken Access Control vulnerability
- CVE-2026-24601 WordPress Penci Pay Writer plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24600 WordPress Penci Review plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2460 Missing authorization in Relion REB500
- CVE-2026-24599 WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-24598 WordPress Multilanguage by BestWebSoft plugin <= 1.5.2 - Broken Access Control vulnerability
- CVE-2026-24597 WordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24596 Cross-site request forgery in Related Posts Thumbnails Plugin for WordPress
- CVE-2026-24595 WordPress Zoho CRM Lead Magnet plugin <= 1.8.1.9 - Broken Access Control vulnerability
- CVE-2026-24594 WordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24593 WordPress AWP Classifieds plugin <= 4.4.3 - Sensitive Data Exposure vulnerability
- CVE-2026-24592 WordPress Auto Affiliate Links plugin <= 6.8.8.3 - Broken Access Control vulnerability
- CVE-2026-24591 WordPress Turn Yoast SEO FAQ Block to Accordion plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24590 WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Broken Access Control vulnerability
- CVE-2026-2459 Privilege escalation in Relion REB500
- CVE-2026-24589 WordPress Cargus plugin <= 1.5.8 - Sensitive Data Exposure vulnerability
- CVE-2026-24588 WordPress Smart Product Viewer plugin <= 1.5.4 - Broken Access Control vulnerability
- CVE-2026-24587 WordPress AJAX Hits Counter + Popular Posts Widget plugin <= 0.10.210305 - Broken Access Control vulnerability
- CVE-2026-24586 WordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerability
- CVE-2026-24585 WordPress Hyyan WooCommerce Polylang Integration plugin <= 1.5.0 - Broken Access Control vulnerability
- CVE-2026-24584 WordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24583 WordPress SumUp Payment Gateway For WooCommerce plugin <= 2.7.9 - Broken Access Control vulnerability
- CVE-2026-24582 WordPress FlexTable plugin <= 3.24.0 - Broken Access Control vulnerability
- CVE-2026-24581 WordPress Points and Rewards for WooCommerce plugin <= 2.9.5 - Broken Access Control vulnerability
- CVE-2026-24580 WordPress Ecwid Shopping Cart plugin <= 7.0.5 - Broken Access Control vulnerability
- CVE-2026-2458 Unauthorized channel enumeration in private teams after member removal
- CVE-2026-24579 WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Broken Access Control vulnerability
- CVE-2026-24578 WordPress Admin login URL Change plugin <= 1.1.5 - Broken Access Control vulnerability
- CVE-2026-24577 WordPress Pie Register plugin <= 3.8.4.8 - Broken Access Control vulnerability
- CVE-2026-24576 WordPress UX Flat plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24575 WordPress WishList Member X plugin <= 3.29.0 - Broken Access Control vulnerability
- CVE-2026-24574 WordPress Export WP Page to Static HTML/CSS plugin <= 6.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24573 WordPress Visualizer plugin < 4.0.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24572 WordPress Nelio Content plugin <= 4.2.0 - SQL Injection vulnerability
- CVE-2026-24571 WordPress BOX NOW Delivery plugin <= 3.0.2 - Broken Access Control vulnerability
- CVE-2026-24570 WordPress Edwiser Bridge plugin <= 4.3.2 - Broken Access Control vulnerability
- CVE-2026-2457 WebSocket Message Spoofing via Permalink Embed Manipulation
- CVE-2026-24569 WordPress Media Library File Size plugin <= 1.6.7 - Broken Access Control vulnerability
- CVE-2026-24568 WordPress WP Travel plugin <= 11.1.0 - Broken Access Control vulnerability
- CVE-2026-24567 WordPress Anything Order by Terms plugin <= 1.4.0 - Broken Access Control vulnerability
- CVE-2026-24566 WordPress iNET Webkit plugin <= 1.2.4 - Broken Access Control vulnerability
- CVE-2026-24565 WordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerability
- CVE-2026-24564 WordPress Textmetrics plugin <= 3.6.5 - Content Injection vulnerability
- CVE-2026-24563 WordPress LifePress plugin <= 2.2.1 - Broken Access Control vulnerability
- CVE-2026-24562 WordPress Ryviu – Product Reviews for WooCommerce plugin <= 3.1.26 - Broken Access Control vulnerability
- CVE-2026-24561 WordPress FluentBoards plugin <= 1.91.1 - Broken Access Control vulnerability
- CVE-2026-24560 WordPress Cloudinary plugin <= 3.3.2 - Broken Access Control vulnerability
- CVE-2026-2456 Denial of Service via Unbounded Memory Allocation in Integration Actions
- CVE-2026-24559 WordPress Integration for Contact Form 7 HubSpot plugin <= 1.4.3 - Sensitive Data Exposure vulnerability
- CVE-2026-24558 WordPress ABG Rich Pins plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24557 WordPress Contact Form 7 GetResponse Extension plugin <= 1.0.8 - Sensitive Data Exposure vulnerability
- CVE-2026-24556 WordPress ElementCamp plugin <= 2.3.2 - Broken Access Control vulnerability
- CVE-2026-24555 WordPress ArtPlacer Widget plugin <= 2.23.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24554 WordPress WPSubscription plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24553 WordPress Fraud Prevention For Woocommerce plugin <= 2.3.2 - Sensitive Data Exposure vulnerability
- CVE-2026-24552 WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability
- CVE-2026-24551 WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerability
- CVE-2026-24550 WordPress Blockons plugin <= 1.2.19 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2455 SSRF bypass via IPv4-mapped IPv6 literals
- CVE-2026-24549 WordPress GeoDirectory plugin <= 2.8.149 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24548 WordPress Radio Player plugin <= 2.0.91 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-24547 WordPress SiteGround Email Marketing plugin <= 1.7.5 - Broken Access Control vulnerability
- CVE-2026-24546 WordPress GamiPress plugin <= 7.6.3 - Broken Access Control vulnerability
- CVE-2026-24545 WordPress QR Redirector plugin <= 2.0.3 - Broken Access Control vulnerability
- CVE-2026-24544 WordPress HD Quiz plugin <= 2.0.9 - Broken Access Control vulnerability
- CVE-2026-24543 WordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerability
- CVE-2026-24542 WordPress WP Term Order plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24541 WordPress Download After Email plugin <= 2.1.9 - Broken Access Control vulnerability