Skip to content
OpenAdvisories

Archive

14 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /14 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

46 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-1754

    personal-authors-category <= 0.3 - Reflected Cross-Site Scripting

    The personal-authors-category plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate…

    alexeyknyazev personal-authors-category Web / CMS
  • Medium 4.4
    CVE-2026-2027

    AMP Enhancer <= 1.0.49 - Authenticated (Administrator+) Stored Cross-Site Scripting via AMP Custom CSS Setting

    The AMP Enhancer – Compatibility Layer for Official AMP Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AMP Custom CSS setting in all versions up to, and including, 1.0.49 due to insufficient input sanitization and output escaping on…

    ampenhancer AMP Enhancer – Compatibility Layer for Official AMP Plugin Web / CMS
  • Medium 5.3
    CVE-2025-14608

    WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification

    The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5. This is due to the plugin not validating a user's access to a post before modifying its metadata in the 'bulk_save' A…

    infosatech WP Last Modified Info Web / CMS
  • Medium 5.3
    CVE-2025-13973

    StickEasy Protected Contact Form <= 1.0.1 - Unauthenticated Information Disclosure

    The StickEasy Protected Contact Form plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.0.2. The plugin stores spam detection logs at a predictable publicly accessible location (wp-content/uploads/st…

    kasuga16 StickEasy Protected Contact Form Web / CMS
  • Medium 5.3
    CVE-2025-14067

    Easy Form Builder <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure

    The Easy Form Builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber…

    hassantafreshi Easy Form Builder by WhiteStudio – Drag & Drop Form Builder Web / CMS
  • Medium 4.9
    CVE-2025-13681

    BFG Tools – Extension Zipper <= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first_file' Parameter

    The BFG Tools – Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input validation on the user-supplied `first_file` parameter in the `zip()` function. This makes it …

    thebaldfatguy BFG Tools – Extension Zipper Web / CMS