Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,650 results · page 187 of 773
Feb 23, 2026Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions.CVE-2024-58041 · Other software · WONKO · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions. Smolder 1.51 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Smolder::DB::Developer uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
- Product
- Smolder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Feb 23, 2026Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a crafCVE-2026-3062 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.8
Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Feb 23, 2026Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.CVE-2026-3061 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.1
Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Feb 23, 2026ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endCVE-2026-23693 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates certain parameters, including the list parameter, when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwpmet.com
Feb 23, 2026TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable.CVE-2025-70327 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The ip parameter is retrieved via websGetVar and passed to a ping command through CsteSystem without validating if the input starts with a hyphen (-). This allows remote authenticated attackers to inject arbitrary command-line options into the ping utility, potentially leading to a Denial of Service (DoS) by causing excessive resource consumption or prolonged execution.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master.CVE-2025-70043 · Other software · reported by MITRECritical 9.1
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in TLS socket options
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 23, 2026SQL injection vulnerability in Infoticketing.CVE-2025-41002 · Other software · MANANTIAL DE IDEAS · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by sending a POST request using the 'code' parameter in '/components/cart/cartApplyDiscount.php'.
- Product
- Infoticketing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.CVE-2026-23552 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.
- Product
- Apache Camel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcamel.apache.orggithub.com
Feb 22, 2026SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to accesCVE-2026-24494 · Other software · Order Up · reported by 66fe30d5-b042-4547-a192-c18da4c41a81Critical 9.8
SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to access sensitive backend database data via a crafted store_id parameter in a POST request.
- Product
- Online Ordering System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2026Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems.CVE-2026-2588 · Other software · TIMLEGGE · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems. Sodium.xs casts a STRLEN (size_t) to unsigned long long when passing a length pointer to libsodium functions. On 32-bit systems size_t is typically 32-bits while an unsigned long long is at least 64-bits.
- Product
- Crypt::NaCl::Sodium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026OneUptime is a solution for monitoring and managing online services.CVE-2026-27574 · Other software · OneUptime · reported by GitHubCritical 9.9
OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, allowing trivial sandbox escape via a well-known one-liner that grants full access to the underlying process. Because the probe runs with host networking and holds all cluster credentials (ONEUPTIME_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, CLICKHOUSE_PASSWORD) in its environment variables, and monitor creation is available to the lowest role (ProjectMember) with open registration enabled by default, any anonymous user can achieve full cluster compromise in about 30 seconds. This issue has been fixed in version 10.0.5.
- Product
- oneuptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026ERP is a free and open source Enterprise Resource Planning tool.CVE-2026-27471 · Other software · frappe · reported by GitHubCritical 9.3
ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules (BER) and Distinguished Encoding Rules (DER).CVE-2026-27452 · Other software · JonathanWilbur · reported by GitHubCritical 9.2
ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules (BER) and Distinguished Encoding Rules (DER). In versions 11.0.5 and below, in some cases, decoding an INTEGER could leak the underlying ArrayBuffer. This issue is expected to be fixed in version 11.0.6.
- Product
- asn1-ts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior.CVE-2026-27212 · Other software · nolimits4web · reported by GitHubCritical 9.4
Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. Any application that processes attacker-controlled input using this package may be affected by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.
- Product
- swiper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads.CVE-2026-27211 · Other software · cloud-hypervisor · reported by GitHubCritical 9.1
Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration (constrained by process privileges) when using virtio-block devices backed by raw images. A malicious guest can overwrite its disk header with a crafted QCOW2 structure pointing to a sensitive host path. Upon the next VM boot or disk scan, the image format auto-detection parses this header and serves the host file's contents to the guest. Guest-initiated VM reboots are sufficient to trigger a disk scan and do not cause the Cloud Hypervisor process to exit. Therefore, a single VM can perform this attack without needing interaction from the management stack. Successful exploitation requires the backing image to be either writable by the guest or sourced from an untrusted origin. Deployments utilizing only trusted, read-only images are not affected. This issue has been fixed in version 50.1. To workaround, enable land lock sandboxing and restrict process privileges and access.
- Product
- cloud-hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026Sentry is a developer-first error tracking and performance monitoring tool.CVE-2026-27197 · Other software · getsentry · reported by GitHubCritical 9.1
Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Self-hosted users are only at risk if the following criteria is met: ore than one organizations are configured (SENTRY_SINGLE_ORGANIZATION = True), or malicious user has existing access and permissions to modify SSO settings for another organization in a multo-organization instance. This issue has been fixed in version 26.2.0. To workaround this issue, implement user account-based two-factor authentication to prevent an attacker from being able to complete authentication with a victim's user account. Organization administrators cannot do this on a user's behalf, this requires individual users to ensure 2FA has been enabled for their account.
- Product
- sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability.CVE-2026-2039 · Other software · GFI · reported by zdi-disclosures@trendmicro.comCritical 9.8
GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MArc.Store.Remoting.exe process, which listens on port 8018. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-28597.
- Product
- Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability.CVE-2026-2038 · Other software · GFI · reported by zdi-disclosures@trendmicro.comCritical 9.8
GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MArc.Core.Remoting.exe process, which listens on port 8017. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-27934.
- Product
- Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious inpuCVE-2019-25441 · Other software · kostasmitroglou · reported by VulnCheckCritical 9.3
thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the run_command endpoint. Attackers can send POST requests with shell commands in the command parameter to execute arbitrary code on the server without authentication.
- Product
- thesystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 20, 2026Kargo manages and automates the promotion of software artifacts.CVE-2026-27112 · Other software · akuity · reported by GitHubCritical 9.4
Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can manifest a bug present in the logic of both endpoints to inject arbitrary resources (of specific types only) into the underlying namespace of an existing Project using the API server's own permissions when that behavior was not intended. Critically, an attacker may exploit this as a vector for elevating their own permissions, which can then be leveraged to achieve remote code execution or secret exfiltration. Exfiltrated artifact repository credentials can be leveraged, in turn, to execute further attacks. In some configurations of the Kargo control plane's underlying Kubernetes cluster, elevated permissions may additionally be leveraged to achieve remote code execution or secret exfiltration using kubectl. This can reduce the complexity of the attack, however, worst case scenarios remain entirely achievable even without this. This vulnerability is fixed in v1.7.8, v1.8.11, and v1.9.3.
- Product
- kargo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.CVE-2026-25896 · Other software · NaturalIntelligence · reported by GitHubCritical 9.3
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
- Product
- fast-xml-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026PROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command injection via shell metacharacters in the ip parameter (for satelCVE-2021-35402 · Other software · PROLiNK · reported by MITRECritical 10
PROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command injection via shell metacharacters in the ip parameter (for satellite_status).
- Product
- PRC2402M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.CVE-2026-2333 · Other software · Owl · reported by prodsec@nozominetworks.comCritical 9.2
Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.
- Product
- opds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined CVE-2026-26747 · Other software · Monicahq · reported by MITRECritical 9.1
A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The application generates absolute URLs (such as those used in password reset emails) using the user-supplied Host header. This allows remote attackers to poison the password reset link sent to a victim,
- Product
- Monica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the AccessID parameter.CVE-2026-26725 · Other software · Edubusinesssolutions · reported by MITRECritical 9.8
An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the AccessID parameter.
- Product
- Print Shop Pro Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login funCVE-2026-26722 · Other software · Keystorage · reported by MITRECritical 9.4
An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login functionality.
- Product
- Global Facilities Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026The web management interface of the device allows the administrator username and password to be set to blank values.CVE-2026-25715 · Other software · Jinan USR IOT Technology Limited (PUSR) · reported by ics-cert@hq.dhs.govCritical 9.8
The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative control without credentials.
- Product
- USR-W610
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fuCVE-2025-70833 · Other software · Lkw199711 · reported by MITRECritical 9.4
An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.
- Product
- Smanga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Download Manager Addons for Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24956 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada Download Manager Addons for Elementor wpdm-elementor allows Blind SQL Injection.This issue affects Download Manager Addons for Elementor: from n/a through <= 1.3.0.
- Product
- Download Manager Addons for Elementor
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Download Manager Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Applay - Shortcodes: Deserialization of Untrusted DataCVE-2026-22384 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This issue affects Applay - Shortcodes: from n/a through <= 3.7.
- Product
- Applay - Shortcodes
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update Applay - Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface.CVE-2025-70831 · Other software · Lkw199711 · reported by MITRECritical 9.8
A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properly sanitize user-supplied input in the mediaId parameter before using it in a system shell command. This allows an unauthenticated attacker to inject arbitrary operating system commands, leading to complete server compromise.
- Product
- Smanga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Lorem Ipsum | Books & Media Store: Deserialization of Untrusted DataCVE-2025-69405 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum | Books & Media Store: from n/a through <= 1.2.11.
- Product
- Lorem Ipsum | Books & Media Store
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update Lorem Ipsum | Books & Media Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Extreme Store: Deserialization of Untrusted DataCVE-2025-69404 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a through <= 1.5.10.
- Product
- Extreme Store
- Affected
- up to 1.5.10
- What to do
- Affects up to 1.5.10. Update Extreme Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Bravis Addons: Unrestricted Upload of File with Dangerous TypeCVE-2025-69403 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Bravis-Themes Bravis Addons bravis-addons allows Using Malicious Files.This issue affects Bravis Addons: from n/a through <= 1.3.0.
- Product
- Bravis Addons
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Bravis Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Themesflat Elementor: Deserialization of Untrusted DataCVE-2025-69382 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themesflat Themesflat Elementor themesflat-elementor allows Object Injection.This issue affects Themesflat Elementor: from n/a through <= 1.0.1.
- Product
- Themesflat Elementor
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Themesflat Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026SevenHills: Deserialization of Untrusted DataCVE-2025-69372 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes SevenHills sevenhills allows Object Injection.This issue affects SevenHills: from n/a through <= 1.6.2.
- Product
- SevenHills
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update SevenHills to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026KindlyCare: Deserialization of Untrusted DataCVE-2025-69371 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes KindlyCare kindlycare allows Object Injection.This issue affects KindlyCare: from n/a through <= 1.6.1.
- Product
- KindlyCare
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update KindlyCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Capella: Deserialization of Untrusted DataCVE-2025-69370 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.
- Product
- Capella
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update Capella to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Emerce Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69366 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Emerce Core emerce-core allows Blind SQL Injection.This issue affects Emerce Core: from n/a through <= 1.8.
- Product
- Emerce Core
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Emerce Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Uroan Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69365 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Uroan Core uroan-core allows Blind SQL Injection.This issue affects Uroan Core: from n/a through <= 1.4.4.
- Product
- Uroan Core
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Uroan Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Wolmart Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69337 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Wolmart Core wolmart-core allows Blind SQL Injection.This issue affects Wolmart Core: from n/a through <= 1.9.6.
- Product
- Wolmart Core
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update Wolmart Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Prestige: Deserialization of Untrusted DataCVE-2025-69329 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Jthemes Prestige prestige allows Object Injection.This issue affects Prestige: from n/a through < 1.4.1.
- Product
- Prestige
- What to do
- Update Prestige to the newest version.
Feb 20, 2026Woodly Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69310 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Woodly Core woodly-core allows Blind SQL Injection.This issue affects Woodly Core: from n/a through <= 1.4.
- Product
- Woodly Core
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Woodly Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Saasplate Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69309 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Saasplate Core saasplate-core allows Blind SQL Injection.This issue affects Saasplate Core: from n/a through <= 1.2.8.
- Product
- Saasplate Core
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Saasplate Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Nestbyte Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69308 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Nestbyte Core nestbyte-core allows Blind SQL Injection.This issue affects Nestbyte Core: from n/a through <= 1.2.
- Product
- Nestbyte Core
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Nestbyte Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Medinik Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69307 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Medinik Core medinik-core allows Blind SQL Injection.This issue affects Medinik Core: from n/a through <= 1.3.6.
- Product
- Medinik Core
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update Medinik Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Electio Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69306 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Electio Core electio-core allows Blind SQL Injection.This issue affects Electio Core: from n/a through <= 1.4.
- Product
- Electio Core
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Electio Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Crete Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69305 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Crete Core crete-core allows Blind SQL Injection.This issue affects Crete Core: from n/a through <= 1.4.3.
- Product
- Crete Core
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Crete Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Allmart: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69304 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Allmart allmart-core allows Blind SQL Injection.This issue affects Allmart: from n/a through <= 1.1.
- Product
- Allmart
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Allmart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026PhotoMe: Deserialization of Untrusted DataCVE-2025-69301 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.
- Product
- PhotoMe
- Affected
- up to 5.6.11
- What to do
- Affects up to 5.6.11. Update PhotoMe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.