# Vulnerabilities published in 2026


- [CVE-2026-24632](https://insights.sbomify.com/CVE-2026-24632/): WordPress Delay Redirects plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-24631](https://insights.sbomify.com/CVE-2026-24631/): WordPress Rosebud theme <= 1.4 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-24630](https://insights.sbomify.com/CVE-2026-24630/): WordPress Stylish Cost Calculator plugin <= 8.2.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-2463](https://insights.sbomify.com/CVE-2026-2463/): Unauthorized access to invite ID during team creation (medium 4.3)
- [CVE-2026-24629](https://insights.sbomify.com/CVE-2026-24629/): WordPress Web Accessibility with Max Access plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-24628](https://insights.sbomify.com/CVE-2026-24628/): WordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-24627](https://insights.sbomify.com/CVE-2026-24627/): WordPress Trusona for WordPress plugin <= 2.0.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24626](https://insights.sbomify.com/CVE-2026-24626/): WordPress Logo Slider plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-24625](https://insights.sbomify.com/CVE-2026-24625/): WordPress File Uploads Addon for WooCommerce plugin <= 1.7.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24624](https://insights.sbomify.com/CVE-2026-24624/): WordPress Neoforum plugin <= 1.0 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-24623](https://insights.sbomify.com/CVE-2026-24623/): WordPress Neoforum plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-24622](https://insights.sbomify.com/CVE-2026-24622/): WordPress Suggestion Toolkit plugin <= 5.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-24621](https://insights.sbomify.com/CVE-2026-24621/): WordPress Terms descriptions plugin <= 3.4.9 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-24620](https://insights.sbomify.com/CVE-2026-24620/): WordPress Landing Page Builder plugin <= 1.5.3.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-2462](https://insights.sbomify.com/CVE-2026-2462/): Admin RCE via Malicious Plugin Upload on CI Test Instances (medium 6.6)
- [CVE-2026-24619](https://insights.sbomify.com/CVE-2026-24619/): WordPress PopCash.Net Code Integration Tool plugin <= 1.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24618](https://insights.sbomify.com/CVE-2026-24618/): WordPress Hash Elements plugin <= 1.5.4 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-24617](https://insights.sbomify.com/CVE-2026-24617/): WordPress Easy Modal plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24616](https://insights.sbomify.com/CVE-2026-24616/): WordPress WP Popups plugin <= 2.2.0.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-24615](https://insights.sbomify.com/CVE-2026-24615/): WordPress Cream Magazine theme <= 2.1.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24614](https://insights.sbomify.com/CVE-2026-24614/): WordPress Flex QR Code Generator plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-24613](https://insights.sbomify.com/CVE-2026-24613/): WordPress Ecwid Shopping Cart plugin <= 7.0.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24612](https://insights.sbomify.com/CVE-2026-24612/): WordPress Orchid Store theme <= 1.5.15 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24611](https://insights.sbomify.com/CVE-2026-24611/): WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability (critical 9.1)
- [CVE-2026-24610](https://insights.sbomify.com/CVE-2026-24610/): WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-2461](https://insights.sbomify.com/CVE-2026-2461/): Missing authorization check allows unauthorized modification of other users' comments on a board (medium 4.3)
- [CVE-2026-24609](https://insights.sbomify.com/CVE-2026-24609/): WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-24608](https://insights.sbomify.com/CVE-2026-24608/): WordPress Laurent Core plugin <= 2.4.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-24607](https://insights.sbomify.com/CVE-2026-24607/): WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24606](https://insights.sbomify.com/CVE-2026-24606/): WordPress Bayarcash WooCommerce plugin <= 4.3.13 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24605](https://insights.sbomify.com/CVE-2026-24605/): WordPress X Addons for Elementor plugin <= 1.0.23 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24604](https://insights.sbomify.com/CVE-2026-24604/): WordPress Simple GDPR Cookie Compliance plugin <= 2.0.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24603](https://insights.sbomify.com/CVE-2026-24603/): WordPress Universal Google Adsense and Ads manager plugin <= 1.1.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24601](https://insights.sbomify.com/CVE-2026-24601/): WordPress Penci Pay Writer plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24600](https://insights.sbomify.com/CVE-2026-24600/): WordPress Penci Review plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-2460](https://insights.sbomify.com/CVE-2026-2460/): Missing authorization in Relion REB500 (high 7.6)
- [CVE-2026-24599](https://insights.sbomify.com/CVE-2026-24599/): WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-24598](https://insights.sbomify.com/CVE-2026-24598/): WordPress Multilanguage by BestWebSoft plugin <= 1.5.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24597](https://insights.sbomify.com/CVE-2026-24597/): WordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-24596](https://insights.sbomify.com/CVE-2026-24596/): Cross-site request forgery in Related Posts Thumbnails Plugin for WordPress (medium 4.3)
- [CVE-2026-24595](https://insights.sbomify.com/CVE-2026-24595/): WordPress Zoho CRM Lead Magnet plugin <= 1.8.1.9 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-24594](https://insights.sbomify.com/CVE-2026-24594/): WordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-24593](https://insights.sbomify.com/CVE-2026-24593/): WordPress AWP Classifieds plugin <= 4.4.3 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-24592](https://insights.sbomify.com/CVE-2026-24592/): WordPress Auto Affiliate Links plugin <= 6.8.8.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24591](https://insights.sbomify.com/CVE-2026-24591/): WordPress Turn Yoast SEO FAQ Block to Accordion plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24590](https://insights.sbomify.com/CVE-2026-24590/): WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-2459](https://insights.sbomify.com/CVE-2026-2459/): Privilege escalation in Relion REB500 (high 7.4)
- [CVE-2026-24589](https://insights.sbomify.com/CVE-2026-24589/): WordPress Cargus plugin <= 1.5.8 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-24588](https://insights.sbomify.com/CVE-2026-24588/): WordPress Smart Product Viewer plugin <= 1.5.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24587](https://insights.sbomify.com/CVE-2026-24587/): WordPress AJAX Hits Counter + Popular Posts Widget plugin <= 0.10.210305 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-24586](https://insights.sbomify.com/CVE-2026-24586/): WordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-24585](https://insights.sbomify.com/CVE-2026-24585/): WordPress Hyyan WooCommerce Polylang Integration plugin <= 1.5.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-24584](https://insights.sbomify.com/CVE-2026-24584/): WordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-24583](https://insights.sbomify.com/CVE-2026-24583/): WordPress SumUp Payment Gateway For WooCommerce plugin <= 2.7.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24582](https://insights.sbomify.com/CVE-2026-24582/): WordPress FlexTable plugin <= 3.24.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24581](https://insights.sbomify.com/CVE-2026-24581/): WordPress Points and Rewards for WooCommerce plugin <= 2.9.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-24580](https://insights.sbomify.com/CVE-2026-24580/): WordPress Ecwid Shopping Cart plugin <= 7.0.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-2458](https://insights.sbomify.com/CVE-2026-2458/): Unauthorized channel enumeration in private teams after member removal (medium 4.3)
- [CVE-2026-24579](https://insights.sbomify.com/CVE-2026-24579/): WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24578](https://insights.sbomify.com/CVE-2026-24578/): WordPress Admin login URL Change plugin <= 1.1.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24577](https://insights.sbomify.com/CVE-2026-24577/): WordPress Pie Register plugin <= 3.8.4.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24576](https://insights.sbomify.com/CVE-2026-24576/): WordPress UX Flat plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24575](https://insights.sbomify.com/CVE-2026-24575/): WordPress WishList Member X plugin <= 3.29.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24574](https://insights.sbomify.com/CVE-2026-24574/): WordPress Export WP Page to Static HTML/CSS plugin <= 6.0.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2026-24573](https://insights.sbomify.com/CVE-2026-24573/): WordPress Visualizer plugin < 4.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24572](https://insights.sbomify.com/CVE-2026-24572/): WordPress Nelio Content plugin <= 4.2.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-24571](https://insights.sbomify.com/CVE-2026-24571/): WordPress BOX NOW Delivery plugin <= 3.0.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24570](https://insights.sbomify.com/CVE-2026-24570/): WordPress Edwiser Bridge plugin <= 4.3.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-2457](https://insights.sbomify.com/CVE-2026-2457/): WebSocket Message Spoofing via Permalink Embed Manipulation (medium 4.3)
- [CVE-2026-24569](https://insights.sbomify.com/CVE-2026-24569/): WordPress Media Library File Size plugin <= 1.6.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24568](https://insights.sbomify.com/CVE-2026-24568/): WordPress WP Travel plugin <= 11.1.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24567](https://insights.sbomify.com/CVE-2026-24567/): WordPress Anything Order by Terms plugin <= 1.4.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24566](https://insights.sbomify.com/CVE-2026-24566/): WordPress iNET Webkit plugin <= 1.2.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-24565](https://insights.sbomify.com/CVE-2026-24565/): WordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-24564](https://insights.sbomify.com/CVE-2026-24564/): WordPress Textmetrics plugin <= 3.6.5 - Content Injection vulnerability (medium 4.3)
- [CVE-2026-24563](https://insights.sbomify.com/CVE-2026-24563/): WordPress LifePress plugin <= 2.2.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24562](https://insights.sbomify.com/CVE-2026-24562/): WordPress Ryviu – Product Reviews for WooCommerce plugin <= 3.1.26 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24561](https://insights.sbomify.com/CVE-2026-24561/): WordPress FluentBoards plugin <= 1.91.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-24560](https://insights.sbomify.com/CVE-2026-24560/): WordPress Cloudinary plugin <= 3.3.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-2456](https://insights.sbomify.com/CVE-2026-2456/): Denial of Service via Unbounded Memory Allocation in Integration Actions (medium 5.3)
- [CVE-2026-24559](https://insights.sbomify.com/CVE-2026-24559/): WordPress Integration for Contact Form 7 HubSpot plugin <= 1.4.3 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-24558](https://insights.sbomify.com/CVE-2026-24558/): WordPress ABG Rich Pins plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24557](https://insights.sbomify.com/CVE-2026-24557/): WordPress Contact Form 7 GetResponse Extension plugin <= 1.0.8 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-24556](https://insights.sbomify.com/CVE-2026-24556/): WordPress ElementCamp plugin <= 2.3.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24555](https://insights.sbomify.com/CVE-2026-24555/): WordPress ArtPlacer Widget plugin <= 2.23.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24554](https://insights.sbomify.com/CVE-2026-24554/): WordPress WPSubscription plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-24553](https://insights.sbomify.com/CVE-2026-24553/): WordPress Fraud Prevention For Woocommerce plugin <= 2.3.2 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-24552](https://insights.sbomify.com/CVE-2026-24552/): WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-24551](https://insights.sbomify.com/CVE-2026-24551/): WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-24550](https://insights.sbomify.com/CVE-2026-24550/): WordPress Blockons plugin <= 1.2.19 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-2455](https://insights.sbomify.com/CVE-2026-2455/): SSRF bypass via IPv4-mapped IPv6 literals (medium 4.3)
- [CVE-2026-24549](https://insights.sbomify.com/CVE-2026-24549/): WordPress GeoDirectory plugin <= 2.8.149 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-24548](https://insights.sbomify.com/CVE-2026-24548/): WordPress Radio Player plugin <= 2.0.91 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2026-24547](https://insights.sbomify.com/CVE-2026-24547/): WordPress SiteGround Email Marketing plugin <= 1.7.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24546](https://insights.sbomify.com/CVE-2026-24546/): WordPress GamiPress plugin <= 7.6.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24545](https://insights.sbomify.com/CVE-2026-24545/): WordPress QR Redirector plugin <= 2.0.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24544](https://insights.sbomify.com/CVE-2026-24544/): WordPress HD Quiz plugin <= 2.0.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24543](https://insights.sbomify.com/CVE-2026-24543/): WordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24542](https://insights.sbomify.com/CVE-2026-24542/): WordPress WP Term Order plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-24541](https://insights.sbomify.com/CVE-2026-24541/): WordPress Download After Email plugin <= 2.1.9 - Broken Access Control vulnerability (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/778/