CVEs

408,314 total · page 1719 of 8,167

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-27042	WordPress Notificationx	Med	0.34	5.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through <= 3.2.1.
CVE-2026-26362	Dell Unisphere For Powermax	Hig	0.53	8.1	0.00	Feb 19, 2026	Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system files.
CVE-2026-26361	Dell Unisphere For Powermax	Med	0.42	6.5	0.00	Feb 19, 2026	Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVE-2026-26360	Dell Unisphere For Powermax	Hig	0.53	8.1	0.00	Feb 19, 2026	Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to delete arbitrary files.
CVE-2026-26359	Dell Unisphere For Powermax	Hig	0.57	8.8	0.00	Feb 19, 2026	Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files.
CVE-2026-26358	Dell Unisphere For Powermax	Hig	0.57	8.8	0.00	Feb 19, 2026	Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVE-2026-25473	WordPress WZone	Med	0.35	5.4	0.00	Feb 19, 2026	Missing Authorization vulnerability in AA-Team WZone woozone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WZone: from n/a through <= 14.0.31.
CVE-2026-25472	WordPress Fusion Builder	Med	0.42	6.5	0.00	Feb 19, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Stored XSS.This issue affects Fusion Builder: from n/a through <= 3.14.1.
CVE-2026-25463	WordPress Wpresidence Core	Med	0.42	6.5	0.00	Feb 19, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate Wpresidence Core wpresidence-core allows Stored XSS.This issue affects Wpresidence Core: from n/a through <= 5.4.0.
CVE-2026-25459	WordPress Sober	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in uixthemes Sober sober allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sober: from n/a through <= 3.5.12.
CVE-2026-25453	Tinywebgallery Advanced iFrame	Med	0.42	6.5	0.00	Feb 19, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdempfle Advanced iFrame advanced-iframe allows DOM-Based XSS.This issue affects Advanced iFrame: from n/a through <= 2025.10.
CVE-2026-25451	WordPress Bold Page Builder	Med	0.42	6.5	0.00	Feb 19, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.6.9.
CVE-2026-25441	WordPress Leadconnector	Med	0.34	5.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in varunvairavanlc LeadConnector leadconnector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LeadConnector: from n/a through <= 3.0.21.
CVE-2026-25432	WordPress Omnipress	Med	0.42	6.5	0.00	Feb 19, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This issue affects Omnipress: from n/a through <= 1.6.7.
CVE-2026-25428	WordPress Ts Poll	Med	0.29	4.4	0.00	Feb 19, 2026	Server-Side Request Forgery (SSRF) vulnerability in totalsoft TS Poll poll-wp allows Server Side Request Forgery.This issue affects TS Poll: from n/a through <= 2.5.5.
CVE-2026-25423	WordPress Real3d Flipbook Lite	Low	0.25	3.8	0.00	Feb 19, 2026	Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real 3D FlipBook: from n/a through <= 4.19.1.
CVE-2026-25422	WordPress Popularis Extra	Med	0.35	5.4	0.00	Feb 19, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Themes4WP Popularis Extra popularis-extra allows Cross Site Request Forgery.This issue affects Popularis Extra: from n/a through <= 1.2.10.
CVE-2026-25420	WordPress Mailerlite	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18.
CVE-2026-25419	WordPress UpsellWP	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through <= 2.2.5.
CVE-2026-25418	WordPress Bit Form	Hig	0.49	7.6	0.00	Feb 19, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through <= 2.21.10.
CVE-2026-25416	WordPress News Kit Elementor Addons	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
CVE-2026-25415	WordPress WPBookit Pro	Med	0.34	5.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPBookit Pro: from n/a through <= 1.6.18.
CVE-2026-25412	—		0.00	—	—	Feb 19, 2026	Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-25411	WordPress Revision Manager TMC	Med	0.28	4.3	0.00	Feb 19, 2026	Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects Revision Manager TMC: from n/a through <= 2.8.22.
CVE-2026-25410	WordPress WP-CORS	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in tstephenson WP-CORS wp-cors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CORS: from n/a through <= 0.2.2.
CVE-2026-25409	WordPress JAMstack Deployments	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in crgeary JAMstack Deployments wp-jamstack-deployments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JAMstack Deployments: from n/a through <= 1.1.1.
CVE-2026-25408	WordPress Broken Link Notifier	Med	0.34	5.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in PluginRx Broken Link Notifier broken-link-notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Notifier: from n/a through <= 1.3.5.
CVE-2026-25407	WordPress Cookiebot	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in cookiebot Cookiebot cookiebot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookiebot: from n/a through <= 4.6.4.
CVE-2026-25404	WordPress Wp Job Manager	Med	0.34	5.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through <= 2.4.0.
CVE-2026-25402	WordPress Echo Knowledge Base	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in echoplugins Knowledge Base for Documentation, FAQs with AI Assistance echo-knowledge-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance:…
CVE-2026-25399	WordPress Serious Slider	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in CryoutCreations Serious Slider cryout-serious-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serious Slider: from n/a through <= 1.2.7.
CVE-2026-25395	WordPress Business Roy	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in ikreatethemes Business Roy business-roy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Roy: from n/a through <= 1.1.4.
CVE-2026-25394	WordPress Fitness FSE	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fitness FSE: from n/a through <= 1.0.6.
CVE-2026-25393	WordPress Hello FSE	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE: from n/a through <= 1.0.6.
CVE-2026-25392	WordPress Update URLs	Med	0.31	4.7	0.00	Feb 19, 2026	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress update-urls allows Phishing.This issue affects Update URLs – Quick and Easy way to search old…
CVE-2026-25391	WordPress AI Content Generation	Med	0.35	5.4	0.00	Feb 19, 2026	Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through <= 1.3.07.
CVE-2026-25389	WordPress Eventprime	Med	0.34	5.3	0.00	Feb 19, 2026	Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.8.3.
CVE-2026-25388	WordPress Ads Pro	Med	0.35	5.4	0.00	Feb 19, 2026	Missing Authorization vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ads Pro: from n/a through <= 5.0.
CVE-2026-25387	WordPress Image Optimizer by Elementor	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Optimizer by Elementor: from n/a through <= 1.7.1.
CVE-2026-25386	WordPress ally	Med	0.34	5.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ally: from n/a through <= 4.0.2.
CVE-2026-25385	WordPress Shorten URL	Med	0.36	5.5	0.00	Feb 19, 2026	Server-Side Request Forgery (SSRF) vulnerability in KaizenCoders URL Shortify url-shortify allows Server Side Request Forgery.This issue affects URL Shortify: from n/a through <= 1.12.3.
CVE-2026-25384	WordPress Wp Lister For Ebay	Med	0.34	5.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.5.
CVE-2026-25378	WordPress Nelio Ab Testing	Hig	0.49	7.6	0.00	Feb 19, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Blind SQL Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.4.
CVE-2026-25375	WordPress Image Photo Gallery Final Tiles Grid	Med	0.28	4.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.10.
CVE-2026-25374	WordPress Spa and Salon	Med	0.34	5.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spa and Salon: from n/a through <= 1.3.2.
CVE-2026-25372	Kodezen LLC Academy LMS	Med	0.42	6.5	0.00	Feb 19, 2026	Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.5.3.
CVE-2026-25370	WordPress Wp Compress	Med	0.34	5.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress: from n/a through <= 6.60.28.
CVE-2026-25368	WordPress Calculated Fields Form	Med	0.42	6.5	0.00	Feb 19, 2026	Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculated Fields Form: from n/a through <= 5.4.4.1.
CVE-2026-25367	WordPress CitiLights	Med	0.34	5.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through < 3.7.2.
CVE-2026-25364	WordPress Client Invoicing by Sprout Invoices	Med	0.34	5.3	0.00	Feb 19, 2026	Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.

CVE-2026-27042MedFeb 19, 2026
WordPress
Notificationx
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through <= 3.2.1.
CVE-2026-26362HigFeb 19, 2026
Dell
Unisphere For Powermax
risk 0.53cvss 8.1epss 0.00
Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system files.
CVE-2026-26361MedFeb 19, 2026
Dell
Unisphere For Powermax
risk 0.42cvss 6.5epss 0.00
Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVE-2026-26360HigFeb 19, 2026
Dell
Unisphere For Powermax
risk 0.53cvss 8.1epss 0.00
Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to delete arbitrary files.
CVE-2026-26359HigFeb 19, 2026
Dell
Unisphere For Powermax
risk 0.57cvss 8.8epss 0.00
Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files.
CVE-2026-26358HigFeb 19, 2026
Dell
Unisphere For Powermax
risk 0.57cvss 8.8epss 0.00
Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVE-2026-25473MedFeb 19, 2026
WordPress
WZone
risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in AA-Team WZone woozone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WZone: from n/a through <= 14.0.31.
CVE-2026-25472MedFeb 19, 2026
WordPress
Fusion Builder
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Stored XSS.This issue affects Fusion Builder: from n/a through <= 3.14.1.
CVE-2026-25463MedFeb 19, 2026
WordPress
Wpresidence Core
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate Wpresidence Core wpresidence-core allows Stored XSS.This issue affects Wpresidence Core: from n/a through <= 5.4.0.
CVE-2026-25459MedFeb 19, 2026
WordPress
Sober
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in uixthemes Sober sober allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sober: from n/a through <= 3.5.12.
CVE-2026-25453MedFeb 19, 2026
Tinywebgallery
Advanced iFrame
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdempfle Advanced iFrame advanced-iframe allows DOM-Based XSS.This issue affects Advanced iFrame: from n/a through <= 2025.10.
CVE-2026-25451MedFeb 19, 2026
WordPress
Bold Page Builder
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.6.9.
CVE-2026-25441MedFeb 19, 2026
WordPress
Leadconnector
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in varunvairavanlc LeadConnector leadconnector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LeadConnector: from n/a through <= 3.0.21.
CVE-2026-25432MedFeb 19, 2026
WordPress
Omnipress
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This issue affects Omnipress: from n/a through <= 1.6.7.
CVE-2026-25428MedFeb 19, 2026
WordPress
Ts Poll
risk 0.29cvss 4.4epss 0.00
Server-Side Request Forgery (SSRF) vulnerability in totalsoft TS Poll poll-wp allows Server Side Request Forgery.This issue affects TS Poll: from n/a through <= 2.5.5.
CVE-2026-25423LowFeb 19, 2026
WordPress
Real3d Flipbook Lite
risk 0.25cvss 3.8epss 0.00
Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real 3D FlipBook: from n/a through <= 4.19.1.
CVE-2026-25422MedFeb 19, 2026
WordPress
Popularis Extra
risk 0.35cvss 5.4epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Themes4WP Popularis Extra popularis-extra allows Cross Site Request Forgery.This issue affects Popularis Extra: from n/a through <= 1.2.10.
CVE-2026-25420MedFeb 19, 2026
WordPress
Mailerlite
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18.
CVE-2026-25419MedFeb 19, 2026
WordPress
UpsellWP
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through <= 2.2.5.
CVE-2026-25418HigFeb 19, 2026
WordPress
Bit Form
risk 0.49cvss 7.6epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through <= 2.21.10.
CVE-2026-25416MedFeb 19, 2026
WordPress
News Kit Elementor Addons
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
CVE-2026-25415MedFeb 19, 2026
WordPress
WPBookit Pro
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPBookit Pro: from n/a through <= 1.6.18.
CVE-2026-25412Feb 19, 2026
risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-25411MedFeb 19, 2026
WordPress
Revision Manager TMC
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects Revision Manager TMC: from n/a through <= 2.8.22.
CVE-2026-25410MedFeb 19, 2026
WordPress
WP-CORS
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in tstephenson WP-CORS wp-cors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CORS: from n/a through <= 0.2.2.
CVE-2026-25409MedFeb 19, 2026
WordPress
JAMstack Deployments
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in crgeary JAMstack Deployments wp-jamstack-deployments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JAMstack Deployments: from n/a through <= 1.1.1.
CVE-2026-25408MedFeb 19, 2026
WordPress
Broken Link Notifier
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in PluginRx Broken Link Notifier broken-link-notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Notifier: from n/a through <= 1.3.5.
CVE-2026-25407MedFeb 19, 2026
WordPress
Cookiebot
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in cookiebot Cookiebot cookiebot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookiebot: from n/a through <= 4.6.4.
CVE-2026-25404MedFeb 19, 2026
WordPress
Wp Job Manager
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through <= 2.4.0.
CVE-2026-25402MedFeb 19, 2026
WordPress
Echo Knowledge Base
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in echoplugins Knowledge Base for Documentation, FAQs with AI Assistance echo-knowledge-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance:…
CVE-2026-25399MedFeb 19, 2026
WordPress
Serious Slider
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in CryoutCreations Serious Slider cryout-serious-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serious Slider: from n/a through <= 1.2.7.
CVE-2026-25395MedFeb 19, 2026
WordPress
Business Roy
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in ikreatethemes Business Roy business-roy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Roy: from n/a through <= 1.1.4.
CVE-2026-25394MedFeb 19, 2026
WordPress
Fitness FSE
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fitness FSE: from n/a through <= 1.0.6.
CVE-2026-25393MedFeb 19, 2026
WordPress
Hello FSE
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE: from n/a through <= 1.0.6.
CVE-2026-25392MedFeb 19, 2026
WordPress
Update URLs
risk 0.31cvss 4.7epss 0.00
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress update-urls allows Phishing.This issue affects Update URLs – Quick and Easy way to search old…
CVE-2026-25391MedFeb 19, 2026
WordPress
AI Content Generation
risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through <= 1.3.07.
CVE-2026-25389MedFeb 19, 2026
WordPress
Eventprime
risk 0.34cvss 5.3epss 0.00
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.8.3.
CVE-2026-25388MedFeb 19, 2026
WordPress
Ads Pro
risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ads Pro: from n/a through <= 5.0.
CVE-2026-25387MedFeb 19, 2026
WordPress
Image Optimizer by Elementor
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Optimizer by Elementor: from n/a through <= 1.7.1.
CVE-2026-25386MedFeb 19, 2026
WordPress
ally
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ally: from n/a through <= 4.0.2.
CVE-2026-25385MedFeb 19, 2026
WordPress
Shorten URL
risk 0.36cvss 5.5epss 0.00
Server-Side Request Forgery (SSRF) vulnerability in KaizenCoders URL Shortify url-shortify allows Server Side Request Forgery.This issue affects URL Shortify: from n/a through <= 1.12.3.
CVE-2026-25384MedFeb 19, 2026
WordPress
Wp Lister For Ebay
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.5.
CVE-2026-25378HigFeb 19, 2026
WordPress
Nelio Ab Testing
risk 0.49cvss 7.6epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Blind SQL Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.4.
CVE-2026-25375MedFeb 19, 2026
WordPress
Image Photo Gallery Final Tiles Grid
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.10.
CVE-2026-25374MedFeb 19, 2026
WordPress
Spa and Salon
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spa and Salon: from n/a through <= 1.3.2.
CVE-2026-25372MedFeb 19, 2026
Kodezen LLC
Academy LMS
risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.5.3.
CVE-2026-25370MedFeb 19, 2026
WordPress
Wp Compress
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress: from n/a through <= 6.60.28.
CVE-2026-25368MedFeb 19, 2026
WordPress
Calculated Fields Form
risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculated Fields Form: from n/a through <= 5.4.4.1.
CVE-2026-25367MedFeb 19, 2026
WordPress
CitiLights
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through < 3.7.2.
CVE-2026-25364MedFeb 19, 2026
WordPress
Client Invoicing by Sprout Invoices
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.