# Vulnerabilities published in 2026


- [CVE-2026-22402](https://insights.sbomify.com/CVE-2026-22402/): WordPress Triply theme <= 2.4.7 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-22401](https://insights.sbomify.com/CVE-2026-22401/): WordPress Freshio theme <= 2.4.2 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-22400](https://insights.sbomify.com/CVE-2026-22400/): WordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-2240](https://insights.sbomify.com/CVE-2026-2240/): janet-lang janet compile.c janetc_pop_funcdef out-of-bounds (medium 4.8)
- [CVE-2026-22399](https://insights.sbomify.com/CVE-2026-22399/): WordPress Holmes theme <= 1.7 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22398](https://insights.sbomify.com/CVE-2026-22398/): WordPress Fleur theme <= 2.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-22397](https://insights.sbomify.com/CVE-2026-22397/): WordPress Fleur theme <= 2.2.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22396](https://insights.sbomify.com/CVE-2026-22396/): WordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-22395](https://insights.sbomify.com/CVE-2026-22395/): WordPress Fiorello theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22394](https://insights.sbomify.com/CVE-2026-22394/): WordPress Evently theme <= 1.7 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22393](https://insights.sbomify.com/CVE-2026-22393/): WordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-22392](https://insights.sbomify.com/CVE-2026-22392/): WordPress Cortex theme <= 1.9 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22391](https://insights.sbomify.com/CVE-2026-22391/): WordPress Cocco theme <= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-22390](https://insights.sbomify.com/CVE-2026-22390/): WordPress Builderall Builder for WordPress plugin <= 3.0.1 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-2239](https://insights.sbomify.com/CVE-2026-2239/): Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow (low 2.8)
- [CVE-2026-22389](https://insights.sbomify.com/CVE-2026-22389/): WordPress Cocco theme <= 2.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22388](https://insights.sbomify.com/CVE-2026-22388/): WordPress Owl Carousel WP plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-22387](https://insights.sbomify.com/CVE-2026-22387/): WordPress Aviana theme <= 2.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22386](https://insights.sbomify.com/CVE-2026-22386/): WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-22385](https://insights.sbomify.com/CVE-2026-22385/): WordPress Wolmart theme <= 1.9.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22384](https://insights.sbomify.com/CVE-2026-22384/): WordPress Applay - Shortcodes plugin <= 3.7 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-22383](https://insights.sbomify.com/CVE-2026-22383/): Missing authorization in PawFriends - Pet Shop and Veterinary WordPress Theme (high 7.5)
- [CVE-2026-22382](https://insights.sbomify.com/CVE-2026-22382/): Cross-site request forgery in PawFriends - Pet Shop and Veterinary WordPress Theme (medium 5.4)
- [CVE-2026-22381](https://insights.sbomify.com/CVE-2026-22381/): WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22380](https://insights.sbomify.com/CVE-2026-22380/): WordPress UnlimHost theme <= 1.2.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2238](https://insights.sbomify.com/CVE-2026-2238/): Missing Authorization in GitLab (medium 5.3)
- [CVE-2026-22379](https://insights.sbomify.com/CVE-2026-22379/): WordPress Netmix theme <= 1.0.10 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22378](https://insights.sbomify.com/CVE-2026-22378/): WordPress Blabber theme <= 1.7.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22377](https://insights.sbomify.com/CVE-2026-22377/): WordPress Saveo theme <= 1.1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22376](https://insights.sbomify.com/CVE-2026-22376/): WordPress Parkivia theme <= 1.1.9 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22375](https://insights.sbomify.com/CVE-2026-22375/): WordPress Impacto Patronus theme <= 1.2.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22374](https://insights.sbomify.com/CVE-2026-22374/): WordPress Zio Alberto theme <= 1.2.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22373](https://insights.sbomify.com/CVE-2026-22373/): WordPress Fooddy theme <= 1.3.10 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22372](https://insights.sbomify.com/CVE-2026-22372/): WordPress Isida theme <= 1.4.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22371](https://insights.sbomify.com/CVE-2026-22371/): WordPress Gustavo theme <= 1.2.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22370](https://insights.sbomify.com/CVE-2026-22370/): WordPress Marveland theme <= 1.3.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2237](https://insights.sbomify.com/CVE-2026-2237/): Information disclosure in Storage Manager (medium 6.2)
- [CVE-2026-22369](https://insights.sbomify.com/CVE-2026-22369/): WordPress Ironfit theme <= 1.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22368](https://insights.sbomify.com/CVE-2026-22368/): WordPress Redy theme <= 1.0.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22367](https://insights.sbomify.com/CVE-2026-22367/): WordPress Coworking theme <= 1.6.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22366](https://insights.sbomify.com/CVE-2026-22366/): WordPress Jude theme <= 1.3.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22365](https://insights.sbomify.com/CVE-2026-22365/): WordPress Soleng theme <= 1.0.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22364](https://insights.sbomify.com/CVE-2026-22364/): WordPress SevenTrees theme <=1.0.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22363](https://insights.sbomify.com/CVE-2026-22363/): WordPress Rhodos theme <= 1.3.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22362](https://insights.sbomify.com/CVE-2026-22362/): WordPress Photolia theme <= 1.0.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22361](https://insights.sbomify.com/CVE-2026-22361/): WordPress A-Mart theme <= 1.0.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22360](https://insights.sbomify.com/CVE-2026-22360/): WordPress SearchAzon plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-2236](https://insights.sbomify.com/CVE-2026-2236/): HGiga｜C&Cm@il - SQL Injection (high 8.7)
- [CVE-2026-22359](https://insights.sbomify.com/CVE-2026-22359/): WordPress Wordpress Movies Bulk Importer plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-22358](https://insights.sbomify.com/CVE-2026-22358/): WordPress Electrician - Electrical Service WordPress theme <= 5.6 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2026-22357](https://insights.sbomify.com/CVE-2026-22357/): WordPress Link Whisper Free plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22356](https://insights.sbomify.com/CVE-2026-22356/): WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-22355](https://insights.sbomify.com/CVE-2026-22355/): WordPress Simple XML Sitemap plugin <= 1.3 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2026-22354](https://insights.sbomify.com/CVE-2026-22354/): WordPress Woocommerce Category Banner Management plugin <= 2.5.1 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-22353](https://insights.sbomify.com/CVE-2026-22353/): WordPress teachPress plugin <= 9.0.12 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-22352](https://insights.sbomify.com/CVE-2026-22352/): WordPress Persian Woocommerce SMS plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22351](https://insights.sbomify.com/CVE-2026-22351/): WordPress WP FullCalendar plugin <= 1.6 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-22350](https://insights.sbomify.com/CVE-2026-22350/): Missing authorization in PDF for Elementor Forms + Drag And Drop Template Builder (medium 6.5)
- [CVE-2026-2235](https://insights.sbomify.com/CVE-2026-2235/): HGiga｜C&Cm@il - SQL Injection (high 7.1)
- [CVE-2026-22349](https://insights.sbomify.com/CVE-2026-22349/): WordPress Menu In Post plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-22348](https://insights.sbomify.com/CVE-2026-22348/): WordPress Civic Cookie Control plugin <= 1.53 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-22347](https://insights.sbomify.com/CVE-2026-22347/): WordPress Carousel Horizontal Posts Content Slider plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-22346](https://insights.sbomify.com/CVE-2026-22346/): Deserialization in Slider Responsive Slideshow – Image slider, Gallery slideshow (high 8.8)
- [CVE-2026-22345](https://insights.sbomify.com/CVE-2026-22345/): Deserialization in Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery (high 8.8)
- [CVE-2026-22344](https://insights.sbomify.com/CVE-2026-22344/): WordPress FiveStar theme <= 1.7 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22343](https://insights.sbomify.com/CVE-2026-22343/): WordPress WordPress Dating Theme theme <= 11.2.0 - Broken Access Control vulnerability (high 8.6)
- [CVE-2026-22342](https://insights.sbomify.com/CVE-2026-22342/): WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability (high 8.8)
- [CVE-2026-22341](https://insights.sbomify.com/CVE-2026-22341/): WordPress Booked plugin <= 3.0.0 - Account Takeover vulnerability (medium 6.7)
- [CVE-2026-22340](https://insights.sbomify.com/CVE-2026-22340/): WordPress WPJobster theme <= 6.3.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-2234](https://insights.sbomify.com/CVE-2026-2234/): HGiga｜C&Cm@il - Missing Authentication (critical 9.3)
- [CVE-2026-22339](https://insights.sbomify.com/CVE-2026-22339/): WordPress WPJobster theme <= 6.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22338](https://insights.sbomify.com/CVE-2026-22338/): WordPress EcoBlue theme <= 1.15 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22337](https://insights.sbomify.com/CVE-2026-22337/): WordPress Directorist Social Login plugin < 2.1.4 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-22336](https://insights.sbomify.com/CVE-2026-22336/): WordPress Directorist Booking plugin < 3.0.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-22335](https://insights.sbomify.com/CVE-2026-22335/): WordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-22334](https://insights.sbomify.com/CVE-2026-22334/): WordPress Woocommerce Book Price plugin <= 1.3 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2026-22333](https://insights.sbomify.com/CVE-2026-22333/): WordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerability (high 7.2)
- [CVE-2026-22332](https://insights.sbomify.com/CVE-2026-22332/): WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-22331](https://insights.sbomify.com/CVE-2026-22331/): WordPress AutoParts theme <= 1.5.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22330](https://insights.sbomify.com/CVE-2026-22330/): WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2233](https://insights.sbomify.com/CVE-2026-2233/): Missing authorization in User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration (medium 5.3)
- [CVE-2026-22329](https://insights.sbomify.com/CVE-2026-22329/): WordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22328](https://insights.sbomify.com/CVE-2026-22328/): WordPress Auto Repair theme <= 22.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22327](https://insights.sbomify.com/CVE-2026-22327/): WordPress Restaurt theme <= 1.0.4 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-22326](https://insights.sbomify.com/CVE-2026-22326/): WordPress Reprizo theme <= 1.0.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22325](https://insights.sbomify.com/CVE-2026-22325/): WordPress Promo theme <= 1.3.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22324](https://insights.sbomify.com/CVE-2026-22324/): WordPress Melania theme <= 2.5.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22323](https://insights.sbomify.com/CVE-2026-22323/): Cross‑Site Request Forgery in Link Aggregation Configuration (high 7.1)
- [CVE-2026-22322](https://insights.sbomify.com/CVE-2026-22322/): Stored Cross‑Site Scripting in Link Aggregation Name Handling (high 7.1)
- [CVE-2026-22321](https://insights.sbomify.com/CVE-2026-22321/): Stack-Based Buffer Overflow in CLI Login Username Handling over CLI (medium 5.3)
- [CVE-2026-22320](https://insights.sbomify.com/CVE-2026-22320/): Stack-Based Buffer Overflow in TFTP File-Transfer Command Handling over CLI (medium 6.5)
- [CVE-2026-2232](https://insights.sbomify.com/CVE-2026-2232/): SQL injection in Product Table and List Builder for WooCommerce Lite (high 7.5)
- [CVE-2026-22319](https://insights.sbomify.com/CVE-2026-22319/): Stack-Based Buffer Overflow in File Install Parameter Handling (medium 4.9)
- [CVE-2026-22318](https://insights.sbomify.com/CVE-2026-22318/): Stack-Based Buffer Overflow in File Transfer Parameter Handling (medium 4.9)
- [CVE-2026-22317](https://insights.sbomify.com/CVE-2026-22317/): Command Injection Vulnerability in Root CA Certificate Transfer Workflow (high 7.2)
- [CVE-2026-22316](https://insights.sbomify.com/CVE-2026-22316/): Buffer Overflow using TFTP Filename (medium 6.5)
- [CVE-2026-22313](https://insights.sbomify.com/CVE-2026-22313/): OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector (critical 9.1)
- [CVE-2026-22312](https://insights.sbomify.com/CVE-2026-22312/): Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector (high 8.6)
- [CVE-2026-2231](https://insights.sbomify.com/CVE-2026-2231/): Fluent Booking <= 2.0.01 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters (high 7.2)
- [CVE-2026-22306](https://insights.sbomify.com/CVE-2026-22306/): Critical flaw impacting OZOLS ERP's automatic update channel (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/799/