Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 22 of 86
Feb 19, 2026LeadConnector: Missing AuthorizationCVE-2026-25441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in varunvairavanlc LeadConnector leadconnector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LeadConnector: from n/a through <= 3.0.21.
- Product
- LeadConnector
- Affected
- up to 3.0.21
- What to do
- Affects up to 3.0.21. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Real 3D FlipBook: Missing AuthorizationCVE-2026-25423 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real 3D FlipBook: from n/a through <= 4.19.1.
- Product
- Real 3D FlipBook
- Affected
- up to 4.19.1
- What to do
- Affects up to 4.19.1. Update Real 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026MailerLite: Missing AuthorizationCVE-2026-25420 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18.
- Product
- MailerLite
- Affected
- up to 1.7.18
- What to do
- Affects up to 1.7.18. Update MailerLite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026UpsellWP: Missing AuthorizationCVE-2026-25419 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through <= 2.2.5.
- Product
- UpsellWP
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update UpsellWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026News Kit Elementor Addons: Missing AuthorizationCVE-2026-25416 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
- Product
- News Kit Elementor Addons
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WPBookit Pro: Missing AuthorizationCVE-2026-25415 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPBookit Pro: from n/a through <= 1.6.18.
- Product
- WPBookit Pro
- Affected
- up to 1.6.18
- What to do
- Affects up to 1.6.18. Update WPBookit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP-CORS: Missing AuthorizationCVE-2026-25410 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tstephenson WP-CORS wp-cors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CORS: from n/a through <= 0.2.2.
- Product
- WP-CORS
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update WP-CORS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026JAMstack Deployments: Missing AuthorizationCVE-2026-25409 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in crgeary JAMstack Deployments wp-jamstack-deployments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JAMstack Deployments: from n/a through <= 1.1.1.
- Product
- JAMstack Deployments
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update JAMstack Deployments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Broken Link Notifier: Missing AuthorizationCVE-2026-25408 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PluginRx Broken Link Notifier broken-link-notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Notifier: from n/a through <= 1.3.5.
- Product
- Broken Link Notifier
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Broken Link Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Cookiebot: Missing AuthorizationCVE-2026-25407 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in cookiebot Cookiebot cookiebot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookiebot: from n/a through <= 4.6.4.
- Product
- Cookiebot
- Affected
- up to 4.6.4
- What to do
- Affects up to 4.6.4. Update Cookiebot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP Job Manager: Missing AuthorizationCVE-2026-25404 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through <= 2.4.0.
- Product
- WP Job Manager
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Knowledge Base for Documentation, FAQs with AI Assistance: Missing AuthorizationCVE-2026-25402 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in echoplugins Knowledge Base for Documentation, FAQs with AI Assistance echo-knowledge-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through <= 16.011.0.
- Product
- Knowledge Base for Documentation, FAQs with AI Assistance
- Affected
- up to 16.011.0
- What to do
- Affects up to 16.011.0. Update Knowledge Base for Documentation, FAQs with AI Assistance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Serious Slider: Missing AuthorizationCVE-2026-25399 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CryoutCreations Serious Slider cryout-serious-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serious Slider: from n/a through <= 1.2.7.
- Product
- Serious Slider
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Serious Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Business Roy: Missing AuthorizationCVE-2026-25395 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ikreatethemes Business Roy business-roy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Roy: from n/a through <= 1.1.4.
- Product
- Business Roy
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Business Roy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Fitness FSE: Missing AuthorizationCVE-2026-25394 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fitness FSE: from n/a through <= 1.0.6.
- Product
- Fitness FSE
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Fitness FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Hello FSE: Missing AuthorizationCVE-2026-25393 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE: from n/a through <= 1.0.6.
- Product
- Hello FSE
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Hello FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP Wand: Missing AuthorizationCVE-2026-25391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through <= 1.3.07.
- Product
- WP Wand
- Affected
- up to 1.3.07
- What to do
- Affects up to 1.3.07. Update WP Wand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Ads Pro: Missing AuthorizationCVE-2026-25388 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ads Pro: from n/a through <= 5.0.
- Product
- Ads Pro
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update Ads Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Image Optimizer by Elementor: Missing AuthorizationCVE-2026-25387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Optimizer by Elementor: from n/a through <= 1.7.1.
- Product
- Image Optimizer by Elementor
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Image Optimizer by Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Ally: Missing AuthorizationCVE-2026-25386 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ally: from n/a through <= 4.0.2.
- Product
- Ally
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Ally to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP-Lister Lite for eBay: Missing AuthorizationCVE-2026-25384 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.5.
- Product
- WP-Lister Lite for eBay
- Affected
- up to 3.8.5
- What to do
- Affects up to 3.8.5. Update WP-Lister Lite for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Image Photo Gallery Final Tiles Grid: Missing AuthorizationCVE-2026-25375 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.10.
- Product
- Image Photo Gallery Final Tiles Grid
- Affected
- up to 3.6.10
- What to do
- Affects up to 3.6.10. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Spa and Salon: Missing AuthorizationCVE-2026-25374 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spa and Salon: from n/a through <= 1.3.2.
- Product
- Spa and Salon
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Spa and Salon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Academy LMS: Missing AuthorizationCVE-2026-25372 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.5.3.
- Product
- Academy LMS
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP Compress: Missing AuthorizationCVE-2026-25370 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress: from n/a through <= 6.60.28.
- Product
- WP Compress
- Affected
- up to 6.60.28
- What to do
- Affects up to 6.60.28. Update WP Compress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Calculated Fields Form: Missing AuthorizationCVE-2026-25368 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculated Fields Form: from n/a through <= 5.4.4.1.
- Product
- Calculated Fields Form
- Affected
- up to 5.4.4.1
- What to do
- Affects up to 5.4.4.1. Update Calculated Fields Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026CitiLights: Missing AuthorizationCVE-2026-25367 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through < 3.7.2.
- Product
- CitiLights
- What to do
- Update CitiLights to the newest version.
Feb 19, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-25364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.8
- What to do
- Affects up to 20.8.8. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026FooGallery: Missing AuthorizationCVE-2026-25363 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in FooPlugins FooGallery foogallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FooGallery: from n/a through <= 3.1.11.
- Product
- FooGallery
- Affected
- up to 3.1.11
- What to do
- Affects up to 3.1.11. Update FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Download Alt Text AI: Missing AuthorizationCVE-2026-25348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Alt Text AI: from n/a through <= 1.10.15.
- Product
- Download Alt Text AI
- Affected
- up to 1.10.15
- What to do
- Affects up to 1.10.15. Update Download Alt Text AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026AI ChatBot with ChatGPT and Content Generator by AYS: Missing AuthorizationCVE-2026-25338 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.7.4.
- Product
- AI ChatBot with ChatGPT and Content Generator by AYS
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update AI ChatBot with ChatGPT and Content Generator by AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Coachify: Missing AuthorizationCVE-2026-25336 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpcoachify Coachify coachify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coachify: from n/a through <= 1.1.5.
- Product
- Coachify
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Coachify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Secure Copy Content Protection and Content Locking: Missing AuthorizationCVE-2026-25335 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Secure Copy Content Protection and Content Locking: from n/a through <= 5.0.0.
- Product
- Secure Copy Content Protection and Content Locking
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update Secure Copy Content Protection and Content Locking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Shopwell: Missing AuthorizationCVE-2026-25333 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in peregrinethemes Shopwell shopwell allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shopwell: from n/a through <= 1.0.11.
- Product
- Shopwell
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Shopwell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Endless Posts Navigation: Missing AuthorizationCVE-2026-25332 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Endless Posts Navigation: from n/a through <= 2.2.9.
- Product
- Endless Posts Navigation
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Endless Posts Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026PublishPress Authors: Missing AuthorizationCVE-2026-25330 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Authors: from n/a through <= 4.10.1.
- Product
- PublishPress Authors
- Affected
- up to 4.10.1
- What to do
- Affects up to 4.10.1. Update PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Quiz And Survey Master: Missing AuthorizationCVE-2026-25329 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.
- Product
- Quiz And Survey Master
- Affected
- up to 10.3.4
- What to do
- Affects up to 10.3.4. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026OSM: Missing AuthorizationCVE-2026-25323 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MiKa OSM osm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OSM: from n/a through <= 6.1.12.
- Product
- OSM
- Affected
- up to 6.1.12
- What to do
- Affects up to 6.1.12. Update OSM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026SupportCandy: Missing AuthorizationCVE-2026-25321 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SupportCandy: from n/a through <= 3.4.4.
- Product
- SupportCandy
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Elementor Contact Form DB: Missing AuthorizationCVE-2026-25320 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cool Plugins Elementor Contact Form DB sb-elementor-contact-form-db allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Contact Form DB: from n/a through <= 2.1.3.
- Product
- Elementor Contact Form DB
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Elementor Contact Form DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WiserReview Product Reviews for WooCommerce: Missing AuthorizationCVE-2026-25318 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Wisernotify team WiserReview Product Reviews for WooCommerce wiser-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WiserReview Product Reviews for WooCommerce: from n/a through <= 2.9.
- Product
- WiserReview Product Reviews for WooCommerce
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update WiserReview Product Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026hCaptcha for WP: Missing AuthorizationCVE-2026-25315 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects hCaptcha for WP: from n/a through <= 4.21.1.
- Product
- hCaptcha for WP
- Affected
- up to 4.21.1
- What to do
- Affects up to 4.21.1. Update hCaptcha for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026TOP Table Of Contents: Missing AuthorizationCVE-2026-25314 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah TOP Table Of Contents top-table-of-contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TOP Table Of Contents: from n/a through <= 1.3.31.
- Product
- TOP Table Of Contents
- Affected
- up to 1.3.31
- What to do
- Affects up to 1.3.31. Update TOP Table Of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026FluentForm: Missing AuthorizationCVE-2026-25313 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjahan Jewel FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through <= 6.1.14.
- Product
- FluentForm
- Affected
- up to 6.1.14
- What to do
- Affects up to 6.1.14. Update FluentForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Autoshare for Twitter: Missing AuthorizationCVE-2026-25311 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in 10up Autoshare for Twitter autoshare-for-twitter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoshare for Twitter: from n/a through <= 2.3.1.
- Product
- Autoshare for Twitter
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Autoshare for Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Simple Membership: Missing AuthorizationCVE-2026-25308 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wp.insider Simple Membership simple-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Membership: from n/a through <= 4.6.9.
- Product
- Simple Membership
- Affected
- up to 4.6.9
- What to do
- Affects up to 4.6.9. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Client Portal: Missing AuthorizationCVE-2026-25003 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in madalin.ungureanu Client Portal client-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Portal: from n/a through <= 1.2.1.
- Product
- Client Portal
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Client Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Wheel of Life: Missing AuthorizationCVE-2026-25000 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through <= 1.2.0.
- Product
- Wheel of Life
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Wheel of Life to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Alma: Missing AuthorizationCVE-2026-24999 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Alma Alma alma-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alma: from n/a through <= 5.16.1.
- Product
- Alma
- Affected
- up to 5.16.1
- What to do
- Affects up to 5.16.1. Update Alma to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Ultimate Gift Cards For WooCommerce: Missing AuthorizationCVE-2026-24375 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Gift Cards For WooCommerce: from n/a through <= 3.2.4.
- Product
- Ultimate Gift Cards For WooCommerce
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update Ultimate Gift Cards For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.