Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,297 results · page 141 of 486
Feb 19, 2026YayMail: Missing AuthorizationCVE-2026-27327 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail: from n/a through <= 4.3.2.
- Product
- YayMail
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update YayMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Product Table and List Builder for WooCommerce Lite: Time-based SQL InjectionCVE-2026-2232 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Product Table and List Builder for WooCommerce Lite
- Affected
- up to 4.6.2
- What to do
- Affects up to 4.6.2. Update Product Table and List Builder for WooCommerce Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026wpForo Forum: Time-based SQL InjectionCVE-2026-1581 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- wpForo Forum
- Affected
- up to 2.4.14
- What to do
- Affects up to 2.4.14. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026CoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27094 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoDaddy CoBlocks coblocks allows Stored XSS.This issue affects CoBlocks: from n/a through <= 3.1.16.
- Product
- CoBlocks
- Affected
- up to 3.1.16
- What to do
- Affects up to 3.1.16. Update CoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WPAdverts: Missing AuthorizationCVE-2026-27092 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Greg Winiarski WPAdverts wpadverts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPAdverts: from n/a through <= 2.3.0.
- Product
- WPAdverts
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Kenta Companion: Cross-Site Request Forgery (CSRF)CVE-2026-27090 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Moose Kenta Companion kenta-companion allows Cross Site Request Forgery.This issue affects Kenta Companion: from n/a through <= 1.3.3.
- Product
- Kenta Companion
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Kenta Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Shortcoder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27074 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vaakash Shortcoder shortcoder allows Stored XSS.This issue affects Shortcoder: from n/a through <= 6.5.1.
- Product
- Shortcoder
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update Shortcoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Soledad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27069 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad soledad allows DOM-Based XSS.This issue affects Soledad: from n/a through <= 8.7.2.
- Product
- Soledad
- Affected
- up to 8.7.2
- What to do
- Affects up to 8.7.2. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Penci Recipe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27059 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through <= 4.1.
- Product
- Penci Recipe
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Penci Recipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Penci Podcast: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27058 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Podcast penci-podcast allows DOM-Based XSS.This issue affects Penci Podcast: from n/a through <= 1.7.
- Product
- Penci Podcast
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Penci Podcast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Penci Filter Everything: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27057 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Filter Everything penci-filter-everything allows Stored XSS.This issue affects Penci Filter Everything: from n/a through <= 1.7.
- Product
- Penci Filter Everything
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Penci Filter Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026iThemes Sync: Missing AuthorizationCVE-2026-27056 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StellarWP iThemes Sync ithemes-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through <= 3.2.8.
- Product
- iThemes Sync
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update iThemes Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Penci AI SmartContent Creator: Missing AuthorizationCVE-2026-27055 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PenciDesign Penci AI SmartContent Creator penci-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Penci AI SmartContent Creator: from n/a through <= 2.0.
- Product
- Penci AI SmartContent Creator
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Penci AI SmartContent Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Sales Countdown Timer for WooCommerce and: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27052 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for WooCommerce and WordPress sctv-sales-countdown-timer allows PHP Local File Inclusion.This issue affects Sales Countdown Timer for WooCommerce and WordPress: from n/a through < 1.1.9.
- Product
- Sales Countdown Timer for WooCommerce and
- What to do
- Update Sales Countdown Timer for WooCommerce and to the newest version.
Feb 19, 2026NotificationX: Missing AuthorizationCVE-2026-27042 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through <= 3.2.1.
- Product
- NotificationX
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update NotificationX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WZone: Missing AuthorizationCVE-2026-25473 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AA-Team WZone woozone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WZone: from n/a through <= 14.0.31.
- Product
- WZone
- Affected
- up to 14.0.31
- What to do
- Affects up to 14.0.31. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Fusion Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25472 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Stored XSS.This issue affects Fusion Builder: from n/a through <= 3.14.1.
- Product
- Fusion Builder
- Affected
- up to 3.14.1
- What to do
- Affects up to 3.14.1. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Wpresidence Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25463 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate Wpresidence Core wpresidence-core allows Stored XSS.This issue affects Wpresidence Core: from n/a through <= 5.4.0.
- Product
- Wpresidence Core
- Affected
- up to 5.4.0
- What to do
- Affects up to 5.4.0. Update Wpresidence Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Sober: Missing AuthorizationCVE-2026-25459 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in uixthemes Sober sober allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sober: from n/a through <= 3.5.12.
- Product
- Sober
- Affected
- up to 3.5.12
- What to do
- Affects up to 3.5.12. Update Sober to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Advanced iFrame: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25453 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdempfle Advanced iFrame advanced-iframe allows DOM-Based XSS.This issue affects Advanced iFrame: from n/a through <= 2025.10.
- Product
- Advanced iFrame
- Affected
- up to 2025.10
- What to do
- Affects up to 2025.10. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25451 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.6.9.
- Product
- Bold Page Builder
- Affected
- up to 5.6.9
- What to do
- Affects up to 5.6.9. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026LeadConnector: Missing AuthorizationCVE-2026-25441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in varunvairavanlc LeadConnector leadconnector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LeadConnector: from n/a through <= 3.0.21.
- Product
- LeadConnector
- Affected
- up to 3.0.21
- What to do
- Affects up to 3.0.21. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Omnipress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25432 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This issue affects Omnipress: from n/a through <= 1.6.7.
- Product
- Omnipress
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Real 3D FlipBook: Missing AuthorizationCVE-2026-25423 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real 3D FlipBook: from n/a through <= 4.19.1.
- Product
- Real 3D FlipBook
- Affected
- up to 4.19.1
- What to do
- Affects up to 4.19.1. Update Real 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026MailerLite: Missing AuthorizationCVE-2026-25420 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18.
- Product
- MailerLite
- Affected
- up to 1.7.18
- What to do
- Affects up to 1.7.18. Update MailerLite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026UpsellWP: Missing AuthorizationCVE-2026-25419 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through <= 2.2.5.
- Product
- UpsellWP
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update UpsellWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Bit Form: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25418 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through <= 2.21.10.
- Product
- Bit Form
- Affected
- up to 2.21.10
- What to do
- Affects up to 2.21.10. Update Bit Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026News Kit Elementor Addons: Missing AuthorizationCVE-2026-25416 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
- Product
- News Kit Elementor Addons
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WPBookit Pro: Missing AuthorizationCVE-2026-25415 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPBookit Pro: from n/a through <= 1.6.18.
- Product
- WPBookit Pro
- Affected
- up to 1.6.18
- What to do
- Affects up to 1.6.18. Update WPBookit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Revision Manager TMC: Cross-Site Request Forgery (CSRF)CVE-2026-25411 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects Revision Manager TMC: from n/a through <= 2.8.22.
- Product
- Revision Manager TMC
- Affected
- up to 2.8.22
- What to do
- Affects up to 2.8.22. Update Revision Manager TMC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP-CORS: Missing AuthorizationCVE-2026-25410 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tstephenson WP-CORS wp-cors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CORS: from n/a through <= 0.2.2.
- Product
- WP-CORS
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update WP-CORS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026JAMstack Deployments: Missing AuthorizationCVE-2026-25409 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in crgeary JAMstack Deployments wp-jamstack-deployments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JAMstack Deployments: from n/a through <= 1.1.1.
- Product
- JAMstack Deployments
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update JAMstack Deployments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Broken Link Notifier: Missing AuthorizationCVE-2026-25408 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PluginRx Broken Link Notifier broken-link-notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Notifier: from n/a through <= 1.3.5.
- Product
- Broken Link Notifier
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Broken Link Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Cookiebot: Missing AuthorizationCVE-2026-25407 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in cookiebot Cookiebot cookiebot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookiebot: from n/a through <= 4.6.4.
- Product
- Cookiebot
- Affected
- up to 4.6.4
- What to do
- Affects up to 4.6.4. Update Cookiebot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP Job Manager: Missing AuthorizationCVE-2026-25404 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through <= 2.4.0.
- Product
- WP Job Manager
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Knowledge Base for Documentation, FAQs with AI Assistance: Missing AuthorizationCVE-2026-25402 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in echoplugins Knowledge Base for Documentation, FAQs with AI Assistance echo-knowledge-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through <= 16.011.0.
- Product
- Knowledge Base for Documentation, FAQs with AI Assistance
- Affected
- up to 16.011.0
- What to do
- Affects up to 16.011.0. Update Knowledge Base for Documentation, FAQs with AI Assistance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Serious Slider: Missing AuthorizationCVE-2026-25399 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CryoutCreations Serious Slider cryout-serious-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serious Slider: from n/a through <= 1.2.7.
- Product
- Serious Slider
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Serious Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Business Roy: Missing AuthorizationCVE-2026-25395 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ikreatethemes Business Roy business-roy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Roy: from n/a through <= 1.1.4.
- Product
- Business Roy
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Business Roy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Fitness FSE: Missing AuthorizationCVE-2026-25394 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fitness FSE: from n/a through <= 1.0.6.
- Product
- Fitness FSE
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Fitness FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Hello FSE: Missing AuthorizationCVE-2026-25393 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE: from n/a through <= 1.0.6.
- Product
- Hello FSE
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Hello FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Update URLs – Quick and Easy way to search old links and replace them with new links in: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-25392 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress update-urls allows Phishing.This issue affects Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress: from n/a through <= 1.4.3.
- Product
- Update URLs – Quick and Easy way to search old links and replace them with new links in
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Update URLs – Quick and Easy way to search old links and replace them with new links in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP Wand: Missing AuthorizationCVE-2026-25391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through <= 1.3.07.
- Product
- WP Wand
- Affected
- up to 1.3.07
- What to do
- Affects up to 1.3.07. Update WP Wand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026EventPrime: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25389 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.8.3.
- Product
- EventPrime
- Affected
- up to 4.2.8.3
- What to do
- Affects up to 4.2.8.3. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Ads Pro: Missing AuthorizationCVE-2026-25388 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ads Pro: from n/a through <= 5.0.
- Product
- Ads Pro
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update Ads Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Image Optimizer by Elementor: Missing AuthorizationCVE-2026-25387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Optimizer by Elementor: from n/a through <= 1.7.1.
- Product
- Image Optimizer by Elementor
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Image Optimizer by Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Ally: Missing AuthorizationCVE-2026-25386 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ally: from n/a through <= 4.0.2.
- Product
- Ally
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Ally to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP-Lister Lite for eBay: Missing AuthorizationCVE-2026-25384 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.5.
- Product
- WP-Lister Lite for eBay
- Affected
- up to 3.8.5
- What to do
- Affects up to 3.8.5. Update WP-Lister Lite for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Nelio AB Testing: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25378 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Blind SQL Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.4.
- Product
- Nelio AB Testing
- Affected
- up to 8.2.4
- What to do
- Affects up to 8.2.4. Update Nelio AB Testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Image Photo Gallery Final Tiles Grid: Missing AuthorizationCVE-2026-25375 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.10.
- Product
- Image Photo Gallery Final Tiles Grid
- Affected
- up to 3.6.10
- What to do
- Affects up to 3.6.10. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Spa and Salon: Missing AuthorizationCVE-2026-25374 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spa and Salon: from n/a through <= 1.3.2.
- Product
- Spa and Salon
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Spa and Salon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.