# Vulnerabilities published in 2026


- [CVE-2026-22493](https://insights.sbomify.com/CVE-2026-22493/): WordPress Gaspard theme <= 1.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22492](https://insights.sbomify.com/CVE-2026-22492/): WordPress Docket Cache plugin <= 24.07.04 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-22491](https://insights.sbomify.com/CVE-2026-22491/): WordPress My auctions allegro plugin <= 3.6.35 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22490](https://insights.sbomify.com/CVE-2026-22490/): WordPress Bulk Landing Page Creator for WordPress LPagery plugin <= 2.4.9 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-2249](https://insights.sbomify.com/CVE-2026-2249/): Unauthenticated Remote Command Execution via Web Console in METIS DFS (critical 9.8)
- [CVE-2026-22489](https://insights.sbomify.com/CVE-2026-22489/): WordPress Image Slider Slideshow plugin <= 1.8 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-22488](https://insights.sbomify.com/CVE-2026-22488/): WordPress Dashboard Welcome for Beaver Builder plugin <= 1.0.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-22487](https://insights.sbomify.com/CVE-2026-22487/): WordPress Speed Kit plugin <= 2.0.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-22486](https://insights.sbomify.com/CVE-2026-22486/): WordPress Re Gallery plugin <= 1.18.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-22485](https://insights.sbomify.com/CVE-2026-22485/): WordPress My Album Gallery plugin <= 1.0.4 - Arbitrary File Deletion vulnerability (medium 6.5)
- [CVE-2026-22484](https://insights.sbomify.com/CVE-2026-22484/): WordPress Lisfinity Core plugin <= 1.5.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-22483](https://insights.sbomify.com/CVE-2026-22483/): WordPress teachPress plugin <= 9.0.12 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-22482](https://insights.sbomify.com/CVE-2026-22482/): WordPress IMGspider plugin <= 2.3.12 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2026-22481](https://insights.sbomify.com/CVE-2026-22481/): WordPress BD Courier Order Ratio Checker plugin <= 2.0.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-22480](https://insights.sbomify.com/CVE-2026-22480/): WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-2248](https://insights.sbomify.com/CVE-2026-2248/): Unauthenticated Remote Root Shell Access via Web Console in METIS WIC (critical 9.8)
- [CVE-2026-22479](https://insights.sbomify.com/CVE-2026-22479/): WordPress Easy Post Submission plugin <= 2.4.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-22478](https://insights.sbomify.com/CVE-2026-22478/): WordPress FindAll theme <= 1.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22477](https://insights.sbomify.com/CVE-2026-22477/): WordPress Felizia theme <= 1.3.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22476](https://insights.sbomify.com/CVE-2026-22476/): WordPress Etchy theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22475](https://insights.sbomify.com/CVE-2026-22475/): WordPress Estate theme <= 1.3.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-22474](https://insights.sbomify.com/CVE-2026-22474/): WordPress Equestrian Centre theme <= 1.5 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-22473](https://insights.sbomify.com/CVE-2026-22473/): WordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-22472](https://insights.sbomify.com/CVE-2026-22472/): WordPress Easy Form Builder plugin <= 3.9.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-22471](https://insights.sbomify.com/CVE-2026-22471/): WordPress Secudeal Payments for Ecommerce plugin <= 1.1 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-22470](https://insights.sbomify.com/CVE-2026-22470/): WordPress FireStorm Professional Real Estate plugin <= 2.7.11 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-2247](https://insights.sbomify.com/CVE-2026-2247/): SQL Injection in Clickedu's SaaS platform (high 8.3)
- [CVE-2026-22469](https://insights.sbomify.com/CVE-2026-22469/): WordPress DeepDigital theme <= 1.0.2 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-22468](https://insights.sbomify.com/CVE-2026-22468/): WordPress Absolute Addons For Elementor plugin <= 1.0.14 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-22467](https://insights.sbomify.com/CVE-2026-22467/): WordPress DeepDigital theme <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22466](https://insights.sbomify.com/CVE-2026-22466/): WordPress WP MapIt plugin <= 3.0.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-22465](https://insights.sbomify.com/CVE-2026-22465/): WordPress BuddyApp theme <= 1.9.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22464](https://insights.sbomify.com/CVE-2026-22464/): WordPress My auctions allegro plugin <= 3.6.33 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-22463](https://insights.sbomify.com/CVE-2026-22463/): WordPress Form to Chat App plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-22462](https://insights.sbomify.com/CVE-2026-22462/): WordPress Add Polylang support for Customizer plugin <= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-22461](https://insights.sbomify.com/CVE-2026-22461/): WordPress CTX Feed plugin <= 6.6.18 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-22460](https://insights.sbomify.com/CVE-2026-22460/): WordPress FormGent plugin <= 1.7.0 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2026-2246](https://insights.sbomify.com/CVE-2026-2246/): AprilRobotics apriltag apriltag.c apriltag_detector_detect memory corruption (medium 4.8)
- [CVE-2026-22459](https://insights.sbomify.com/CVE-2026-22459/): WordPress WordPress CTA plugin <= 2.1.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-22458](https://insights.sbomify.com/CVE-2026-22458/): WordPress Wanderland theme <= 1.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-22457](https://insights.sbomify.com/CVE-2026-22457/): WordPress Wanderland theme <= 1.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22456](https://insights.sbomify.com/CVE-2026-22456/): WordPress Askka theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22455](https://insights.sbomify.com/CVE-2026-22455/): WordPress Thebe theme <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22454](https://insights.sbomify.com/CVE-2026-22454/): WordPress Solaris theme <= 2.5 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-22453](https://insights.sbomify.com/CVE-2026-22453/): WordPress Pets Club theme <= 2.3 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-22452](https://insights.sbomify.com/CVE-2026-22452/): WordPress Hoverex theme <= 1.5.10 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22451](https://insights.sbomify.com/CVE-2026-22451/): WordPress Handyman theme <= 1.4.7 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-22450](https://insights.sbomify.com/CVE-2026-22450/): WordPress Don Peppe theme <= 1.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-2245](https://insights.sbomify.com/CVE-2026-2245/): CCExtractor MPEG-TS File ts_tables.c parse_PMT out-of-bounds (medium 4.8)
- [CVE-2026-22449](https://insights.sbomify.com/CVE-2026-22449/): WordPress Don Peppe theme <= 1.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22448](https://insights.sbomify.com/CVE-2026-22448/): WordPress PitchPrint plugin <= 11.1.2 - Arbitrary File Deletion vulnerability (high 7.5)
- [CVE-2026-22447](https://insights.sbomify.com/CVE-2026-22447/): WordPress Prowess theme <= 1.8.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-22446](https://insights.sbomify.com/CVE-2026-22446/): WordPress Prowess theme <= 1.8.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22445](https://insights.sbomify.com/CVE-2026-22445/): WordPress Apimo Connector plugin <= 2.6.5.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-22444](https://insights.sbomify.com/CVE-2026-22444/): Apache Solr: Insufficient file-access checking in standalone core-creation requests (high 7.1)
- [CVE-2026-22443](https://insights.sbomify.com/CVE-2026-22443/): WordPress Alliance theme <= 3.1.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22442](https://insights.sbomify.com/CVE-2026-22442/): WordPress Tribe theme <= 1.7.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22441](https://insights.sbomify.com/CVE-2026-22441/): WordPress Zentrum theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22440](https://insights.sbomify.com/CVE-2026-22440/): WordPress Thecs theme <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-2244](https://insights.sbomify.com/CVE-2026-2244/): Sensitive Data Exposure in Google Cloud Vertex AI Workbench (high 8.4)
- [CVE-2026-22439](https://insights.sbomify.com/CVE-2026-22439/): WordPress Green Planet theme <= 1.1.14 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22438](https://insights.sbomify.com/CVE-2026-22438/): WordPress TheBi theme <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22437](https://insights.sbomify.com/CVE-2026-22437/): WordPress Playa theme <= 1.3.9 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22436](https://insights.sbomify.com/CVE-2026-22436/): WordPress Helvig theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22435](https://insights.sbomify.com/CVE-2026-22435/): WordPress ElectroServ theme <= 1.3.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22434](https://insights.sbomify.com/CVE-2026-22434/): WordPress Crown Art theme <= 1.2.11 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22433](https://insights.sbomify.com/CVE-2026-22433/): WordPress CloudMe theme <= 1.2.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22432](https://insights.sbomify.com/CVE-2026-22432/): WordPress Woopy theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22431](https://insights.sbomify.com/CVE-2026-22431/): WordPress Wabi-Sabi theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22430](https://insights.sbomify.com/CVE-2026-22430/): WordPress Verdure theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-2243](https://insights.sbomify.com/CVE-2026-2243/): Qemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing (medium 5.1)
- [CVE-2026-22429](https://insights.sbomify.com/CVE-2026-22429/): WordPress Verdure theme <= 1.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22428](https://insights.sbomify.com/CVE-2026-22428/): WordPress Tooth Fairy theme <= 1.16 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22427](https://insights.sbomify.com/CVE-2026-22427/): WordPress GoTravel theme <= 2.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22426](https://insights.sbomify.com/CVE-2026-22426/): WordPress Sweet Jane theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-22425](https://insights.sbomify.com/CVE-2026-22425/): WordPress Sweet Jane theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22424](https://insights.sbomify.com/CVE-2026-22424/): WordPress Shaha theme <= 1.1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22423](https://insights.sbomify.com/CVE-2026-22423/): WordPress SetSail theme <= 1.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22422](https://insights.sbomify.com/CVE-2026-22422/): WordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-22421](https://insights.sbomify.com/CVE-2026-22421/): WordPress Quantum theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22420](https://insights.sbomify.com/CVE-2026-22420/): WordPress Horizon theme <= 1.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2242](https://insights.sbomify.com/CVE-2026-2242/): janet-lang janet specials.c janetc_if out-of-bounds (medium 4.8)
- [CVE-2026-22419](https://insights.sbomify.com/CVE-2026-22419/): WordPress Honor theme <= 2.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22418](https://insights.sbomify.com/CVE-2026-22418/): WordPress Great Lotus theme <= 1.3.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22417](https://insights.sbomify.com/CVE-2026-22417/): WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-22416](https://insights.sbomify.com/CVE-2026-22416/): WordPress FixTeam theme <= 1.5.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22415](https://insights.sbomify.com/CVE-2026-22415/): WordPress The Mounty theme <= 1.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22414](https://insights.sbomify.com/CVE-2026-22414/): WordPress Marra theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22413](https://insights.sbomify.com/CVE-2026-22413/): WordPress Malgré theme <= 1.0.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22412](https://insights.sbomify.com/CVE-2026-22412/): WordPress Eona theme <= 1.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22411](https://insights.sbomify.com/CVE-2026-22411/): WordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-22410](https://insights.sbomify.com/CVE-2026-22410/): WordPress Dolcino theme <= 1.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2241](https://insights.sbomify.com/CVE-2026-2241/): janet-lang janet os.c os_strftime out-of-bounds (medium 4.8)
- [CVE-2026-22409](https://insights.sbomify.com/CVE-2026-22409/): WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-22408](https://insights.sbomify.com/CVE-2026-22408/): WordPress Justicia theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22407](https://insights.sbomify.com/CVE-2026-22407/): WordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-22406](https://insights.sbomify.com/CVE-2026-22406/): WordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-22405](https://insights.sbomify.com/CVE-2026-22405/): WordPress Overton theme <= 1.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22404](https://insights.sbomify.com/CVE-2026-22404/): WordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-22403](https://insights.sbomify.com/CVE-2026-22403/): WordPress Innovio theme <= 1.9 - Local File Inclusion vulnerability (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/798/