Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,297 results · page 142 of 486
Feb 19, 2026Academy LMS: Missing AuthorizationCVE-2026-25372 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.5.3.
- Product
- Academy LMS
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP Compress: Missing AuthorizationCVE-2026-25370 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress: from n/a through <= 6.60.28.
- Product
- WP Compress
- Affected
- up to 6.60.28
- What to do
- Affects up to 6.60.28. Update WP Compress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Calculated Fields Form: Missing AuthorizationCVE-2026-25368 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculated Fields Form: from n/a through <= 5.4.4.1.
- Product
- Calculated Fields Form
- Affected
- up to 5.4.4.1
- What to do
- Affects up to 5.4.4.1. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026CitiLights: Missing AuthorizationCVE-2026-25367 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through < 3.7.2.
- Product
- CitiLights
- What to do
- Update CitiLights to the newest version.
Feb 19, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-25364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.8
- What to do
- Affects up to 20.8.8. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026FooGallery: Missing AuthorizationCVE-2026-25363 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in FooPlugins FooGallery foogallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FooGallery: from n/a through <= 3.1.11.
- Product
- FooGallery
- Affected
- up to 3.1.11
- What to do
- Affects up to 3.1.11. Update FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026FooGallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25362 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooGallery foogallery allows Stored XSS.This issue affects FooGallery: from n/a through <= 3.1.11.
- Product
- FooGallery
- Affected
- up to 3.1.11
- What to do
- Affects up to 3.1.11. Update FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Download Alt Text AI: Missing AuthorizationCVE-2026-25348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Alt Text AI: from n/a through <= 1.10.15.
- Product
- Download Alt Text AI
- Affected
- up to 1.10.15
- What to do
- Affects up to 1.10.15. Update Download Alt Text AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25343 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS wp-sms allows DOM-Based XSS.This issue affects WP SMS: from n/a through <= 7.1.
- Product
- WP SMS
- Affected
- up to 7.1
- What to do
- Affects up to 7.1. Update WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026AI ChatBot with ChatGPT and Content Generator by AYS: Missing AuthorizationCVE-2026-25338 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.7.4.
- Product
- AI ChatBot with ChatGPT and Content Generator by AYS
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update AI ChatBot with ChatGPT and Content Generator by AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Coachify: Missing AuthorizationCVE-2026-25336 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpcoachify Coachify coachify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coachify: from n/a through <= 1.1.5.
- Product
- Coachify
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Coachify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Secure Copy Content Protection and Content Locking: Missing AuthorizationCVE-2026-25335 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Secure Copy Content Protection and Content Locking: from n/a through <= 5.0.0.
- Product
- Secure Copy Content Protection and Content Locking
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update Secure Copy Content Protection and Content Locking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Shopwell: Missing AuthorizationCVE-2026-25333 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in peregrinethemes Shopwell shopwell allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shopwell: from n/a through <= 1.0.11.
- Product
- Shopwell
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Shopwell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Endless Posts Navigation: Missing AuthorizationCVE-2026-25332 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Endless Posts Navigation: from n/a through <= 2.2.9.
- Product
- Endless Posts Navigation
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Endless Posts Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP Activity Log: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25331 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n/a through <= 5.5.4.
- Product
- WP Activity Log
- Affected
- up to 5.5.4
- What to do
- Affects up to 5.5.4. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026PublishPress Authors: Missing AuthorizationCVE-2026-25330 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Authors: from n/a through <= 4.10.1.
- Product
- PublishPress Authors
- Affected
- up to 4.10.1
- What to do
- Affects up to 4.10.1. Update PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Quiz And Survey Master: Missing AuthorizationCVE-2026-25329 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.
- Product
- Quiz And Survey Master
- Affected
- up to 10.3.4
- What to do
- Affects up to 10.3.4. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026CMSMasters Content Composer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25326 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows PHP Local File Inclusion.This issue affects CMSMasters Content Composer: from n/a through <= 1.4.5.
- Product
- CMSMasters Content Composer
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update CMSMasters Content Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026rtMedia for WordPress, BuddyPress and bbPress: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25325 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Retrieve Embedded Sensitive Data.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through <= 4.7.8.
- Product
- rtMedia for WordPress, BuddyPress and bbPress
- Affected
- up to 4.7.8
- What to do
- Affects up to 4.7.8. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Quiz And Survey Master: Authorization Bypass Through User-Controlled KeyCVE-2026-25324 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.
- Product
- Quiz And Survey Master
- Affected
- up to 10.3.4
- What to do
- Affects up to 10.3.4. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026OSM: Missing AuthorizationCVE-2026-25323 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MiKa OSM osm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OSM: from n/a through <= 6.1.12.
- Product
- OSM
- Affected
- up to 6.1.12
- What to do
- Affects up to 6.1.12. Update OSM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026PublishPress Revisions: Cross-Site Request Forgery (CSRF)CVE-2026-25322 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PublishPress PublishPress Revisions revisionary allows Cross Site Request Forgery.This issue affects PublishPress Revisions: from n/a through <= 3.7.22.
- Product
- PublishPress Revisions
- Affected
- up to 3.7.22
- What to do
- Affects up to 3.7.22. Update PublishPress Revisions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026SupportCandy: Missing AuthorizationCVE-2026-25321 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SupportCandy: from n/a through <= 3.4.4.
- Product
- SupportCandy
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Elementor Contact Form DB: Missing AuthorizationCVE-2026-25320 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cool Plugins Elementor Contact Form DB sb-elementor-contact-form-db allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Contact Form DB: from n/a through <= 2.1.3.
- Product
- Elementor Contact Form DB
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Elementor Contact Form DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WiserReview Product Reviews for WooCommerce: Missing AuthorizationCVE-2026-25318 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Wisernotify team WiserReview Product Reviews for WooCommerce wiser-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WiserReview Product Reviews for WooCommerce: from n/a through <= 2.9.
- Product
- WiserReview Product Reviews for WooCommerce
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update WiserReview Product Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026CartFlows: Deserialization of Untrusted DataCVE-2026-25316 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Brainstorm Force CartFlows cartflows allows Object Injection.This issue affects CartFlows: from n/a through <= 2.1.19.
- Product
- CartFlows
- Affected
- up to 2.1.19
- What to do
- Affects up to 2.1.19. Update CartFlows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026hCaptcha for WP: Missing AuthorizationCVE-2026-25315 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects hCaptcha for WP: from n/a through <= 4.21.1.
- Product
- hCaptcha for WP
- Affected
- up to 4.21.1
- What to do
- Affects up to 4.21.1. Update hCaptcha for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026TOP Table Of Contents: Missing AuthorizationCVE-2026-25314 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah TOP Table Of Contents top-table-of-contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TOP Table Of Contents: from n/a through <= 1.3.31.
- Product
- TOP Table Of Contents
- Affected
- up to 1.3.31
- What to do
- Affects up to 1.3.31. Update TOP Table Of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026FluentForm: Missing AuthorizationCVE-2026-25313 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjahan Jewel FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through <= 6.1.14.
- Product
- FluentForm
- Affected
- up to 6.1.14
- What to do
- Affects up to 6.1.14. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Autoshare for Twitter: Missing AuthorizationCVE-2026-25311 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in 10up Autoshare for Twitter autoshare-for-twitter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoshare for Twitter: from n/a through <= 2.3.1.
- Product
- Autoshare for Twitter
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Autoshare for Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Simple Membership: Missing AuthorizationCVE-2026-25308 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wp.insider Simple Membership simple-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Membership: from n/a through <= 4.6.9.
- Product
- Simple Membership
- Affected
- up to 4.6.9
- What to do
- Affects up to 4.6.9. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026XStore Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25307 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.7.
- Product
- XStore Core
- What to do
- Update XStore Core to the newest version.
Feb 19, 2026XStore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25305 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through <= 9.6.4.
- Product
- XStore
- Affected
- up to 9.6.4
- What to do
- Affects up to 9.6.4. Update XStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Ninja Tables: Insertion of Sensitive Information Into Sent DataCVE-2026-25008 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Retrieve Embedded Sensitive Data.This issue affects Ninja Tables: from n/a through <= 5.2.5.
- Product
- Ninja Tables
- Affected
- up to 5.2.5
- What to do
- Affects up to 5.2.5. Update Ninja Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026XStore: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-25006 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through <= 9.6.4.
- Product
- XStore
- Affected
- up to 9.6.4
- What to do
- Affects up to 9.6.4. Update XStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Frontend File Manager: Authorization Bypass Through User-Controlled KeyCVE-2026-25005 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frontend File Manager: from n/a through <= 23.5.
- Product
- Frontend File Manager
- Affected
- up to 23.5
- What to do
- Affects up to 23.5. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026CM Business Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25004 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Business Directory cm-business-directory allows Stored XSS.This issue affects CM Business Directory: from n/a through <= 1.5.3.
- Product
- CM Business Directory
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update CM Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Client Portal: Missing AuthorizationCVE-2026-25003 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in madalin.ungureanu Client Portal client-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Portal: from n/a through <= 1.2.1.
- Product
- Client Portal
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Client Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Wheel of Life: Missing AuthorizationCVE-2026-25000 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through <= 1.2.0.
- Product
- Wheel of Life
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Wheel of Life to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Alma: Missing AuthorizationCVE-2026-24999 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Alma Alma alma-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alma: from n/a through <= 5.16.1.
- Product
- Alma
- Affected
- up to 5.16.1
- What to do
- Affects up to 5.16.1. Update Alma to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026HurryTimer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24392 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Stored XSS.This issue affects HurryTimer: from n/a through <= 2.14.2.
- Product
- HurryTimer
- Affected
- up to 2.14.2
- What to do
- Affects up to 2.14.2. Update HurryTimer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Ultimate Gift Cards For WooCommerce: Missing AuthorizationCVE-2026-24375 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Gift Cards For WooCommerce: from n/a through <= 3.2.4.
- Product
- Ultimate Gift Cards For WooCommerce
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update Ultimate Gift Cards For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Media Search Enhanced: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-23805 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yoren Chang Media Search Enhanced media-search-enhanced allows SQL Injection.This issue affects Media Search Enhanced: from n/a through <= 0.9.1.
- Product
- Media Search Enhanced
- Affected
- up to 0.9.1
- What to do
- Affects up to 0.9.1. Update Media Search Enhanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Better Business Reviews: Missing AuthorizationCVE-2026-23804 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1.
- Product
- Better Business Reviews
- Affected
- up to 0.1.1
- What to do
- Affects up to 0.1.1. Update Better Business Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WpEvently: Deserialization of Untrusted DataCVE-2026-23549 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1.
- Product
- WpEvently
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026DirectoryPress: Missing AuthorizationCVE-2026-23548 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through <= 3.6.25.
- Product
- DirectoryPress
- Affected
- up to 3.6.25
- What to do
- Affects up to 3.6.25. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026CMSMasters Content Composer: Missing AuthorizationCVE-2026-23547 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMSMasters Content Composer: from n/a through <= 2.5.8.
- Product
- CMSMasters Content Composer
- Affected
- up to 2.5.8
- What to do
- Affects up to 2.5.8. Update CMSMasters Content Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Aruba HiSpeed Cache: Missing AuthorizationCVE-2026-23545 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aruba HiSpeed Cache: from n/a through <= 3.0.4.
- Product
- Aruba HiSpeed Cache
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Aruba HiSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Valenti: Deserialization of Untrusted DataCVE-2026-23544 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through <= 5.6.3.5.
- Product
- Valenti
- Affected
- up to 5.6.3.5
- What to do
- Affects up to 5.6.3.5. Update Valenti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Essential Addons for Elementor: Missing AuthorizationCVE-2026-23543 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.5.
- Product
- Essential Addons for Elementor
- Affected
- up to 6.5.5
- What to do
- Affects up to 6.5.5. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.