Vulnerability database

4,274 results · page 23 of 86

• Feb 19, 2026Better Business Reviews: Missing AuthorizationCVE-2026-23804 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1.

  Product

  Better Business Reviews

  Affected

  up to 0.1.1

  What to do

  Affects up to 0.1.1. Update Better Business Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026DirectoryPress: Missing AuthorizationCVE-2026-23548 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through <= 3.6.25.

  Product

  DirectoryPress

  Affected

  up to 3.6.25

  What to do

  Affects up to 3.6.25. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026CMSMasters Content Composer: Missing AuthorizationCVE-2026-23547 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Missing Authorization vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMSMasters Content Composer: from n/a through <= 2.5.8.

  Product

  CMSMasters Content Composer

  Affected

  up to 2.5.8

  What to do

  Affects up to 2.5.8. Update CMSMasters Content Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Aruba HiSpeed Cache: Missing AuthorizationCVE-2026-23545 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aruba HiSpeed Cache: from n/a through <= 3.0.4.

  Product

  Aruba HiSpeed Cache

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update Aruba HiSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Essential Addons for Elementor: Missing AuthorizationCVE-2026-23543 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.5.

  Product

  Essential Addons for Elementor

  Affected

  up to 6.5.5

  What to do

  Affects up to 6.5.5. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Mail Mint: Missing AuthorizationCVE-2026-23541 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in WPFunnels Mail Mint mail-mint allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mail Mint: from n/a through <= 1.19.4.

  Product

  Mail Mint

  Affected

  up to 1.19.4

  What to do

  Affects up to 1.19.4. Update Mail Mint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026News Element Elementor Blog Magazine: Missing AuthorizationCVE-2026-2284 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The News Element Elementor Blog Magazine plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.8. This is due to a missing capability check and nonce verification on the 'ne_clean_data' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to truncate 8 core WordPress database tables (posts, comments, terms, term_relationships, term_taxonomy, postmeta, commentmeta, termmeta) and delete the entire WordPress uploads directory, resulting in complete data loss.

  Product

  News Element Elementor Blog Magazine

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update News Element Elementor Blog Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 18, 2026Gutenberg Blocks with AI by Kadence WP: Missing AuthorizationCVE-2026-2633 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due to a missing capability check in the `process_image_data_ajax_callback()` function which handles the `kadence_import_process_image_data` AJAX action. The function's authorization check via `verify_ajax_call()` only validates `edit_posts` capability but fails to check for the `upload_files` capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary images from remote URLs to the WordPress Media Library, bypassing the standard WordPress capability restriction that prevents Contributors from uploading files.

  Product

  Gutenberg Blocks with AI by Kadence WP

  Affected

  up to 3.6.1

  What to do

  Affects up to 3.6.1. Update Gutenberg Blocks with AI by Kadence WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 17, 2026SP Project & Document Manager: Missing AuthorizationCVE-2024-31118 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Smartypants SP Project & Document Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SP Project & Document Manager: from n/a through 4.70.

  Product

  SP Project & Document Manager

  Affected

  up to 4.70

  What to do

  Affects up to 4.70. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 17, 2026Custom Content by Country (by Shield Security): Missing AuthorizationCVE-2022-41650 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Paul Custom Content by Country (by Shield Security) custom-content-by-country.This issue affects Custom Content by Country (by Shield Security): from n/a through 3.1.2.

  Product

  Custom Content by Country (by Shield Security)

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update Custom Content by Country (by Shield Security) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2026MailChimp Campaigns: Missing AuthorizationCVE-2026-1303 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The MailChimp Campaigns plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.2.4. This is due to missing capability checks on the `mailchimp_campaigns_manager_disconnect_app` function that is hooked to the AJAX action of the same name. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the site from its MailChimp synchronization app, disrupting automated email campaigns and marketing integrations.

  Product

  MailChimp Campaigns

  Affected

  up to 3.2.4

  What to do

  Affects up to 3.2.4. Update MailChimp Campaigns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 14, 2026BlueSnap Payment Gateway for WooCommerce: Missing AuthorizationCVE-2026-0692 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.4.0. This is due to the plugin relying on WooCommerce's `WC_Geolocation::get_ip_address()` function to validate IPN requests, which trusts user-controllable headers like X-Real-IP and X-Forwarded-For to determine the client IP address. This makes it possible for unauthenticated attackers to bypass IP allowlist restrictions by spoofing a whitelisted BlueSnap IP address and send forged IPN (Instant Payment Notification) data to manipulate order statuses (mark orders as paid, failed, refunded, or on-hold) without proper authorization.

  Product

  BlueSnap Payment Gateway for WooCommerce

  Affected

  up to 3.4.0

  What to do

  Affects up to 3.4.0. Update BlueSnap Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 7, 2026Post Slides: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-15491 · WordPress plugins & themes · reported by WPScanMedium 5.5

  The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks

  Product

  Post Slides

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Post Slides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Feb 6, 2026WP Duplicate: Missing Authorization leading to Arbitrary File UploadCVE-2026-1499 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The WP Duplicate plugin for WordPress is vulnerable to Missing Authorization leading to Arbitrary File Upload in all versions up to and including 1.1.8. This is due to a missing capability check on the `process_add_site()` AJAX action combined with path traversal in the file upload functionality. This makes it possible for authenticated (subscriber-level) attackers to set the internal `prod_key_random_id` option, which can then be used by an unauthenticated attacker to bypass authentication checks and write arbitrary files to the server via the `handle_upload_single_big_file()` function, ultimately leading to remote code execution.

  Product

  WP Duplicate

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update WP Duplicate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 6, 2026OAuth Single Sign On – SSO (OAuth Client): Unauthorized accessCVE-2025-10753 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is due to missing capability checks and authentication verification on the OAuth redirect functionality accessible via the 'oauthredirect' option parameter. This makes it possible for unauthenticated attackers to set the global redirect URL option via the redirect_url parameter granted they can access the site directly.

  Product

  OAuth Single Sign On – SSO (OAuth Client)

  Affected

  up to 6.26.14

  What to do

  Affects up to 6.26.14. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 5, 2026ELEX WordPress HelpDesk & Customer Ticketing System: Missing AuthorizationCVE-2025-14079 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5. This is due to missing capability checks on the eh_crm_ticket_general function combined with a shared nonce that is exposed to low-privileged users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global WSDesk settings via the `eh_crm_ticket_general` AJAX action.

  Product

  ELEX WordPress HelpDesk & Customer Ticketing System

  Affected

  up to 3.3.5

  What to do

  Affects up to 3.3.5. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 4, 2026MyRewards – Loyalty Points and Rewards for WooCommerce: Missing authorizationCVE-2025-15260 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.

  Product

  MyRewards – Loyalty Points and Rewards for WooCommerce

  Affected

  up to 5.6.1

  What to do

  Affects up to 5.6.1. Update MyRewards – Loyalty Points and Rewards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 3, 2026Passster: Missing AuthorizationCVE-2026-25036 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through <= 4.2.25.

  Product

  Passster

  Affected

  up to 4.2.25

  What to do

  Affects up to 4.2.25. Update Passster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026ElementInvader Addons for Elementor: Missing AuthorizationCVE-2026-25028 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.4.1.

  Product

  ElementInvader Addons for Elementor

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Mizan Demo Importer: Missing AuthorizationCVE-2026-25021 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mizan Demo Importer: from n/a through <= 0.1.3.

  Product

  Mizan Demo Importer

  Affected

  up to 0.1.3

  What to do

  Affects up to 0.1.3. Update Mizan Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WP Sync for Notion: Missing AuthorizationCVE-2026-25020 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WP connect WP Sync for Notion wp-sync-for-notion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sync for Notion: from n/a through <= 1.7.0.

  Product

  WP Sync for Notion

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update WP Sync for Notion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Atarim: Missing AuthorizationCVE-2026-25019 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.1.

  Product

  Atarim

  Affected

  up to 4.3.1

  What to do

  Affects up to 4.3.1. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Nelio Popups: Missing AuthorizationCVE-2026-25016 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Nelio Software Nelio Popups nelio-popups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Popups: from n/a through <= 1.3.5.

  Product

  Nelio Popups

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Nelio Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WP Bannerize Pro: Missing AuthorizationCVE-2026-25012 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bannerize Pro: from n/a through <= 1.11.0.

  Product

  WP Bannerize Pro

  Affected

  up to 1.11.0

  What to do

  Affects up to 1.11.0. Update WP Bannerize Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WP Custom Admin Interface: Missing AuthorizationCVE-2026-25011 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.41.

  Product

  WP Custom Admin Interface

  Affected

  up to 7.41

  What to do

  Affects up to 7.41. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Share This Image: Missing AuthorizationCVE-2026-25010 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share This Image: from n/a through <= 2.09.

  Product

  Share This Image

  Affected

  up to 2.09

  What to do

  Affects up to 2.09. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Wired Impact Volunteer Management: Missing AuthorizationCVE-2026-24997 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wired Impact Volunteer Management: from n/a through <= 2.8.

  Product

  Wired Impact Volunteer Management

  Affected

  up to 2.8

  What to do

  Affects up to 2.8. Update Wired Impact Volunteer Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WPElemento Importer: Missing AuthorizationCVE-2026-24996 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in wpelemento WPElemento Importer wpelemento-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPElemento Importer: from n/a through <= 0.6.4.

  Product

  WPElemento Importer

  Affected

  up to 0.6.4

  What to do

  Affects up to 0.6.4. Update WPElemento Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Latest Post Shortcode: Missing AuthorizationCVE-2026-24995 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Latest Post Shortcode: from n/a through <= 14.2.0.

  Product

  Latest Post Shortcode

  Affected

  up to 14.2.0

  What to do

  Affects up to 14.2.0. Update Latest Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-24994 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2.

  Product

  Sunshine Photo Cart

  Affected

  up to 3.5.7.2

  What to do

  Affects up to 3.5.7.2. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WP Docs: Missing AuthorizationCVE-2026-24990 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through <= 2.2.8.

  Product

  WP Docs

  Affected

  up to 2.2.8

  What to do

  Affects up to 2.2.8. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WP Forms Signature Contract Add-On: Missing AuthorizationCVE-2026-24985 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in approveme WP Forms Signature Contract Add-On wp-forms-signature-contract-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Forms Signature Contract Add-On: from n/a through <= 1.8.2.

  Product

  WP Forms Signature Contract Add-On

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update WP Forms Signature Contract Add-On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Visual Link Preview: Missing AuthorizationCVE-2026-24984 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Brecht Visual Link Preview visual-link-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Link Preview: from n/a through <= 2.2.9.

  Product

  Visual Link Preview

  Affected

  up to 2.2.9

  What to do

  Affects up to 2.2.9. Update Visual Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Spectra: Missing AuthorizationCVE-2026-24982 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through <= 2.19.17.

  Product

  Spectra

  Affected

  up to 2.19.17

  What to do

  Affects up to 2.19.17. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Amelia: Missing AuthorizationCVE-2026-24967 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through <= 1.2.38.

  Product

  Amelia

  Affected

  up to 1.2.38

  What to do

  Affects up to 1.2.38. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Contest Gallery: Missing AuthorizationCVE-2026-24965 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contest Gallery: from n/a through <= 28.1.1.

  Product

  Contest Gallery

  Affected

  up to 28.1.1

  What to do

  Affects up to 28.1.1. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Strong Testimonials: Missing AuthorizationCVE-2026-24957 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through <= 3.2.20.

  Product

  Strong Testimonials

  Affected

  up to 3.2.20

  What to do

  Affects up to 3.2.20. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026myCred: Missing AuthorizationCVE-2026-24951 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 2.9.7.3.

  Product

  myCred

  Affected

  up to 2.9.7.3

  What to do

  Affects up to 2.9.7.3. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026LA-Studio Element Kit for Elementor: Missing AuthorizationCVE-2026-24947 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through < 1.5.6.3.

  Product

  LA-Studio Element Kit for Elementor

  What to do

  Update LA-Studio Element Kit for Elementor to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Ultimate Addons for Contact Form 7: Missing AuthorizationCVE-2026-24945 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through <= 3.5.34.

  Product

  Ultimate Addons for Contact Form 7

  Affected

  up to 3.5.34

  What to do

  Affects up to 3.5.34. Update Ultimate Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Travelfic Toolkit: Missing AuthorizationCVE-2026-24940 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelfic Toolkit: from n/a through <= 1.3.3.

  Product

  Travelfic Toolkit

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Travelfic Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Modula Image Gallery: Missing AuthorizationCVE-2026-24939 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modula Image Gallery: from n/a through <= 2.13.6.

  Product

  Modula Image Gallery

  Affected

  up to 2.13.6

  What to do

  Affects up to 2.13.6. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 28, 2026RegistrationMagic: Missing AuthorizationCVE-2026-1054 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers to modify arbitrary plugin settings, including reCAPTCHA keys, security settings, and frontend menu titles.

  Product

  RegistrationMagic

  Affected

  up to 6.0.7.4

  What to do

  Affects up to 6.0.7.4. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 28, 2026Simple calendar for Elementor: Missing AuthorizationCVE-2026-1310 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. This is due to missing capability checks on the `miga_ajax_editor_cal_delete` function that is hooked to the `miga_editor_cal_delete` AJAX action with both authenticated and unauthenticated access enabled. This makes it possible for unauthenticated attackers to delete arbitrary calendar entries by sending a request with a valid nonce and the calendar entry ID.

  Product

  Simple calendar for Elementor

  Affected

  up to 1.6.6

  What to do

  Affects up to 1.6.6. Update Simple calendar for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 28, 2026Easy Replace Image: Missing AuthorizationCVE-2026-1298 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the `image_replacement_from_url` function that is hooked to the `eri_from_url` AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to replace arbitrary image attachments on the site with images from external URLs, potentially enabling site defacement, phishing attacks, or content manipulation.

  Product

  Easy Replace Image

  Affected

  up to 3.5.2

  What to do

  Affects up to 3.5.2. Update Easy Replace Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 26, 2026Recipe Card Blocks Lite: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-14973 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks.

  Product

  Recipe Card Blocks Lite

  Fixed in

  3.4.13

  What to do

  Update Recipe Card Blocks Lite to 3.4.13 or newer.

  Full record and what to do →NVD recordwpscan.com

• Jan 24, 2026Wise Analytics: Missing AuthorizationCVE-2025-14609 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9. This is due to missing capability checks on the REST API endpoint '/wise-analytics/v1/report'. This makes it possible for unauthenticated attackers to access sensitive analytics data including administrator usernames, login timestamps, visitor tracking information, and business intelligence data via the 'name' parameter granted they can send unauthenticated requests.

  Product

  Wise Analytics

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update Wise Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 23, 2026Sugar Calendar (Lite): Missing AuthorizationCVE-2026-24636 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1.

  Product

  Sugar Calendar (Lite)

  Affected

  up to 3.9.1

  What to do

  Affects up to 3.9.1. Update Sugar Calendar (Lite) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026Add Expires Headers & Optimized Minify: Missing AuthorizationCVE-2026-24633 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Expires Headers & Optimized Minify: from n/a through <= 3.2.0.

  Product

  Add Expires Headers & Optimized Minify

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update Add Expires Headers & Optimized Minify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026Trusona for: Missing AuthorizationCVE-2026-24627 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Trusona Trusona for WordPress trusona allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trusona for WordPress: from n/a through <= 2.0.0.

  Product

  Trusona for

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update Trusona for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.