Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 21 of 86
Feb 20, 2026Aardvark: Missing AuthorizationCVE-2025-69297 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in GhostPool Aardvark Plugin aardvark-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aardvark Plugin: from n/a through <= 2.19.
- Product
- Aardvark
- Affected
- up to 2.19
- What to do
- Affects up to 2.19. Update Aardvark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026New User Approve: Missing AuthorizationCVE-2025-69063 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.0.
- Product
- New User Approve
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026AhaChat Messenger Marketing: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-68895 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in ahachat AhaChat Messenger Marketing ahachat-messenger-marketing allows Password Recovery Exploitation.This issue affects AhaChat Messenger Marketing: from n/a through <= 1.1.
- Product
- AhaChat Messenger Marketing
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update AhaChat Messenger Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026ELEX WordPress HelpDesk & Customer Ticketing System: Missing AuthorizationCVE-2025-68837 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through <= 3.3.5.
- Product
- ELEX WordPress HelpDesk & Customer Ticketing System
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Sync Master Sheet – Product Sync with Google Sheet for WooCommerce: Missing AuthorizationCVE-2025-68834 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Saiful Islam Sync Master Sheet – Product Sync with Google Sheet for WooCommerce product-sync-master-sheet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sync Master Sheet – Product Sync with Google Sheet for WooCommerce: from n/a through <= 1.1.3.
- Product
- Sync Master Sheet – Product Sync with Google Sheet for WooCommerce
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Sync Master Sheet – Product Sync with Google Sheet for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Sendy: Missing AuthorizationCVE-2025-68564 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in sendy Sendy sendy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendy: from n/a through <= 3.4.2.
- Product
- Sendy
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update Sendy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Checkout Gateway for IRIS: Missing AuthorizationCVE-2025-68542 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Gateway for IRIS: from n/a through <= 1.3.
- Product
- Checkout Gateway for IRIS
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Checkout Gateway for IRIS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026PDF for WPForms: Missing AuthorizationCVE-2025-68534 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 6.3.0.
- Product
- PDF for WPForms
- Affected
- up to 6.3.0
- What to do
- Affects up to 6.3.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Directorist: Missing AuthorizationCVE-2025-68069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.6.6.
- Product
- Directorist
- Affected
- up to 8.6.6
- What to do
- Affects up to 8.6.6. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Leadpages: Missing AuthorizationCVE-2025-68050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Leadpages Leadpages leadpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadpages: from n/a through <= 1.1.3.
- Product
- Leadpages
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Leadpages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026NextMove Lite: Missing AuthorizationCVE-2025-68048 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through <= 2.23.0.
- Product
- NextMove Lite
- Affected
- up to 2.23.0
- What to do
- Affects up to 2.23.0. Update NextMove Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026LottieFiles: Missing AuthorizationCVE-2025-68043 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LottieFiles: from n/a through <= 3.0.0.
- Product
- LottieFiles
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update LottieFiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Travelpayouts: Missing AuthorizationCVE-2025-68042 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Travelpayouts Travelpayouts travelpayouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelpayouts: from n/a through <= 1.2.2.
- Product
- Travelpayouts
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Travelpayouts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Advanced WC Analytics: Missing AuthorizationCVE-2025-68032 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Passionate Brains Advanced WC Analytics advance-wc-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced WC Analytics: from n/a through <= 3.19.0.
- Product
- Advanced WC Analytics
- Affected
- up to 3.19.0
- What to do
- Affects up to 3.19.0. Update Advanced WC Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026GA4WP: Google Analytics for: Missing AuthorizationCVE-2025-68028 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GA4WP: Google Analytics for WordPress: from n/a through <= 2.10.0.
- Product
- GA4WP: Google Analytics for
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update GA4WP: Google Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026LC Wizard: Missing AuthorizationCVE-2025-68026 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LC Wizard: from n/a through <= 2.1.1.
- Product
- LC Wizard
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update LC Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Addonify Floating Cart For WooCommerce: Missing AuthorizationCVE-2025-68025 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Addonify Addonify Floating Cart For WooCommerce addonify-floating-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify Floating Cart For WooCommerce: from n/a through <= 1.2.17.
- Product
- Addonify Floating Cart For WooCommerce
- Affected
- up to 1.2.17
- What to do
- Affects up to 1.2.17. Update Addonify Floating Cart For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Addonify – WooCommerce Wishlist: Missing AuthorizationCVE-2025-68024 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Addonify Addonify – WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – WooCommerce Wishlist: from n/a through <= 2.0.15.
- Product
- Addonify – WooCommerce Wishlist
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update Addonify – WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Addonify – Compare Products For WooCommerce: Missing AuthorizationCVE-2025-68023 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Addonify Addonify – Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – Compare Products For WooCommerce: from n/a through <= 1.1.17.
- Product
- Addonify – Compare Products For WooCommerce
- Affected
- up to 1.1.17
- What to do
- Affects up to 1.1.17. Update Addonify – Compare Products For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Plugin BlueX for WooCommerce: Missing AuthorizationCVE-2025-68022 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in soporteblue Plugin BlueX for WooCommerce bluex-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Plugin BlueX for WooCommerce: from n/a through <= 3.1.6.
- Product
- Plugin BlueX for WooCommerce
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Plugin BlueX for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026ConveyThis: Missing AuthorizationCVE-2025-68021 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ConveyThis: from n/a through <= 269.9.
- Product
- ConveyThis
- Affected
- up to 269.9
- What to do
- Affects up to 269.9. Update ConveyThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Easy Hotel Booking: Missing AuthorizationCVE-2025-68005 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in themewant Easy Hotel Booking easy-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Hotel Booking: from n/a through <= 1.9.2.
- Product
- Easy Hotel Booking
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Easy Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Testimonial Slider: Missing AuthorizationCVE-2025-68000 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.
- Product
- Testimonial Slider
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Miraculous Elementor: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-67998 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in kamleshyadav Miraculous Elementor miraculous-el allows Authentication Abuse.This issue affects Miraculous Elementor: from n/a through <= 2.0.7.
- Product
- Miraculous Elementor
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Miraculous Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026YayCurrency: Missing AuthorizationCVE-2025-67994 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in YayCommerce YayCurrency yaycurrency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayCurrency: from n/a through <= 3.3.
- Product
- YayCurrency
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update YayCurrency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Atarim: Missing AuthorizationCVE-2025-67993 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.2.1.
- Product
- Atarim
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026HAPPY: Missing AuthorizationCVE-2025-67977 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.8.
- Product
- HAPPY
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026aDirectory: Missing AuthorizationCVE-2025-67975 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in aDirectory aDirectory adirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects aDirectory: from n/a through <= 3.0.3.
- Product
- aDirectory
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update aDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026WPLegalPages: Missing AuthorizationCVE-2025-67974 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP Legal Pages WPLegalPages wplegalpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLegalPages: from n/a through <= 3.5.4.
- Product
- WPLegalPages
- Affected
- up to 3.5.4
- What to do
- Affects up to 3.5.4. Update WPLegalPages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2025-67973 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.5.6.2
- What to do
- Affects up to 3.5.6.2. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Zoho ZeptoMail: Missing AuthorizationCVE-2025-67972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zoho ZeptoMail: from n/a through 3.2.9.
- Product
- Zoho ZeptoMail
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Zoho ZeptoMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Schedula: Missing AuthorizationCVE-2025-67970 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Missing Authorization vulnerability in vertim Schedula schedula-smart-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schedula: from n/a through <= 1.0.
- Product
- Schedula
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Schedula to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026UPI QR Code Payment Gateway for WooCommerce: Missing AuthorizationCVE-2025-67969 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through <= 1.5.1.
- Product
- UPI QR Code Payment Gateway for WooCommerce
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update UPI QR Code Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Optimize More! – Images: Missing AuthorizationCVE-2025-67624 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Arya Dhiratara Optimize More! – Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! – Images: from n/a through <= 1.1.3.
- Product
- Optimize More! – Images
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Optimize More! – Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Konte: Missing AuthorizationCVE-2025-67547 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in uixthemes Konte konte allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Konte: from n/a through <= 2.4.6.
- Product
- Konte
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Konte to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026AIO WP Builder: Missing AuthorizationCVE-2025-53217 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through <= 2.0.2.
- Product
- AIO WP Builder
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update AIO WP Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Seraphinite Accelerator: Missing AuthorizationCVE-2024-54222 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator allows Retrieve Embedded Sensitive Data.This issue affects Seraphinite Accelerator: from n/a through <= 2.22.15.
- Product
- Seraphinite Accelerator
- Affected
- up to 2.22.15
- What to do
- Affects up to 2.22.15. Update Seraphinite Accelerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026SecuPress Free: Missing AuthorizationCVE-2024-43228 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SecuPress SecuPress Free secupress.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.
- Product
- SecuPress Free
- Affected
- up to 2.2.5.3
- What to do
- Affects up to 2.2.5.3. Update SecuPress Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Shared Files: Missing AuthorizationCVE-2024-34438 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19.
- Product
- Shared Files
- Affected
- up to 1.7.19
- What to do
- Affects up to 1.7.19. Update Shared Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026DirectoryPress: Missing AuthorizationCVE-2026-27387 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through <= 3.6.26.
- Product
- DirectoryPress
- Affected
- up to 3.6.26
- What to do
- Affects up to 3.6.26. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Missing AuthorizationCVE-2026-27368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.
- Product
- Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- Affected
- up to 6.19.8
- What to do
- Affects up to 6.19.8. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026EduBlink: Missing AuthorizationCVE-2026-27328 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DevsBlink EduBlink edublink allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduBlink: from n/a through <= 2.0.7.
- Product
- EduBlink
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update EduBlink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026YayMail: Missing AuthorizationCVE-2026-27327 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail: from n/a through <= 4.3.2.
- Product
- YayMail
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update YayMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Simple Membership: Improper Handling of Missing ValuesCVE-2026-1461 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler. This is due to the plugin only validating webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This makes it possible for unauthenticated attackers to forge Stripe webhook events to manipulate membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially leading to unauthorized access and service disruption.
- Product
- Simple Membership
- Affected
- up to 4.7.0
- What to do
- Affects up to 4.7.0. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026WPAdverts: Missing AuthorizationCVE-2026-27092 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Greg Winiarski WPAdverts wpadverts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPAdverts: from n/a through <= 2.3.0.
- Product
- WPAdverts
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026iThemes Sync: Missing AuthorizationCVE-2026-27056 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StellarWP iThemes Sync ithemes-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through <= 3.2.8.
- Product
- iThemes Sync
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update iThemes Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Penci AI SmartContent Creator: Missing AuthorizationCVE-2026-27055 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PenciDesign Penci AI SmartContent Creator penci-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Penci AI SmartContent Creator: from n/a through <= 2.0.
- Product
- Penci AI SmartContent Creator
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Penci AI SmartContent Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026NotificationX: Missing AuthorizationCVE-2026-27042 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through <= 3.2.1.
- Product
- NotificationX
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update NotificationX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WZone: Missing AuthorizationCVE-2026-25473 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AA-Team WZone woozone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WZone: from n/a through <= 14.0.31.
- Product
- WZone
- Affected
- up to 14.0.31
- What to do
- Affects up to 14.0.31. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Sober: Missing AuthorizationCVE-2026-25459 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in uixthemes Sober sober allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sober: from n/a through <= 3.5.12.
- Product
- Sober
- Affected
- up to 3.5.12
- What to do
- Affects up to 3.5.12. Update Sober to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.