Skip to content
OpenAdvisories

Archive

19 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /19 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

268 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-25451

    WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.6.9.

    Bold Themes Bold Page Builder
  • Medium 6.5
    CVE-2026-25463

    WordPress Wpresidence Core plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate Wpresidence Core wpresidence-core allows Stored XSS.This issue affects Wpresidence Core: from n/a through <= 5.4.0.

    WpEstate Wpresidence Core
  • Medium 4.3
    CVE-2026-25459

    WordPress Sober theme <= 3.5.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in uixthemes Sober sober allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sober: from n/a through <= 3.5.12.

    uixthemes Sober
  • Medium 5.3
    CVE-2026-25441

    WordPress LeadConnector plugin <= 3.0.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in varunvairavanlc LeadConnector leadconnector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LeadConnector: from n/a through <= 3.0.21.

    varunvairavanlc LeadConnector
  • Medium 6.5
    CVE-2026-25472

    WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Stored XSS.This issue affects Fusion Builder: from n/a through <= 3.14.1.

    ThemeFusion Fusion Builder
  • Medium 6.5
    CVE-2026-25453

    WordPress Advanced iFrame plugin <= 2025.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdempfle Advanced iFrame advanced-iframe allows DOM-Based XSS.This issue affects Advanced iFrame: from n/a through <= 2025.10.

    mdempfle Advanced iFrame
  • Medium 5.4
    CVE-2026-25422

    WordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Themes4WP Popularis Extra popularis-extra allows Cross Site Request Forgery.This issue affects Popularis Extra: from n/a through <= 1.2.10.

    Themes4WP Popularis Extra
  • Medium 4.4
    CVE-2026-25428

    WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in totalsoft TS Poll poll-wp allows Server Side Request Forgery.This issue affects TS Poll: from n/a through <= 2.5.5.

    Total-Soft TS Poll
  • Medium 6.5
    CVE-2026-25432

    WordPress Omnipress plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This issue affects Omnipress: from n/a through <= 1.6.7.

    omnipressteam Omnipress
  • Medium 4.3
    CVE-2026-25420

    WordPress MailerLite plugin <= 1.7.18 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18.

    MailerLite MailerLite
  • Medium 4.3
    CVE-2026-25419

    WordPress UpsellWP plugin <= 2.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through <= 2.2.5.

    flycart UpsellWP
  • Medium 4.3
    CVE-2026-25416

    WordPress News Kit Elementor Addons plugin <= 1.4.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.

    blazethemes News Kit Elementor Addons
  • Medium 5.3
    CVE-2026-25415

    WordPress WPBookit Pro plugin <= 1.6.18 - Broken Access Control vulnerability

    Missing Authorization vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPBookit Pro: from n/a through <= 1.6.18.

    Iqonic Design WPBookit Pro
  • Medium 4.3
    CVE-2026-25411

    WordPress Revision Manager TMC plugin <= 2.8.22 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects Revision Manager TMC: from n/a through <= 2.8.22.

    themastercut Revision Manager TMC
  • Medium 5.3
    CVE-2026-25408

    WordPress Broken Link Notifier plugin <= 1.3.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PluginRx Broken Link Notifier broken-link-notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Notifier: from n/a through <= 1.3.5.

    PluginRx Broken Link Notifier
  • Medium 4.3
    CVE-2026-25410

    WordPress WP-CORS plugin <= 0.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in tstephenson WP-CORS wp-cors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CORS: from n/a through <= 0.2.2.

    tstephenson WP-CORS
  • Medium 4.3
    CVE-2026-25409

    WordPress JAMstack Deployments plugin <= 1.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in crgeary JAMstack Deployments wp-jamstack-deployments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JAMstack Deployments: from n/a through <= 1.1.1.

    crgeary JAMstack Deployments
  • Medium 5.3
    CVE-2026-25404

    WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through <= 2.4.0.

    Automattic WP Job Manager
  • Medium 4.3
    CVE-2026-25407

    WordPress Cookiebot plugin <= 4.6.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in cookiebot Cookiebot cookiebot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookiebot: from n/a through <= 4.6.4.

    cookiebot Cookiebot
  • Medium 4.3
    CVE-2026-25402

    WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 16.011.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in echoplugins Knowledge Base for Documentation, FAQs with AI Assistance echo-knowledge-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base for Documentation, FAQs …

    Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance
  • Medium 4.3
    CVE-2026-25394

    WordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fitness FSE: from n/a through <= 1.0.6.

    sparklewpthemes Fitness FSE
  • Medium 4.3
    CVE-2026-25393

    WordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE: from n/a through <= 1.0.6.

    sparklewpthemes Hello FSE
  • Medium 4.3
    CVE-2026-25395

    WordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ikreatethemes Business Roy business-roy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Roy: from n/a through <= 1.1.4.

    ikreatethemes Business Roy
  • Medium 4.3
    CVE-2026-25399

    WordPress Serious Slider plugin <= 1.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CryoutCreations Serious Slider cryout-serious-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serious Slider: from n/a through <= 1.2.7.

    CryoutCreations Serious Slider
  • Medium 4.7
    CVE-2026-25392

    WordPress Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress plugin <= 1.4.0 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress update-urls allows Phishing.This issue affects Update URLs – Quick and Easy way…

    KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress Web / CMS
  • Medium 5.4
    CVE-2026-25391

    WordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through <= 1.3.07.

    WP Grids WP Wand
  • Medium 5.4
    CVE-2026-25388

    WordPress Ads Pro plugin <= 5.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ads Pro: from n/a through <= 5.0.

    scripteo Ads Pro
  • Medium 4.3
    CVE-2026-25387

    WordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Optimizer by Elementor: from n/a through <= 1.7.1.

    Elementor Image Optimizer by Elementor
  • Medium 5.3
    CVE-2026-25389

    WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.8.3.

    Metagauss EventPrime
  • Medium 5.3
    CVE-2026-25386

    WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ally: from n/a through <= 4.0.2.

    Elementor Ally
  • Medium 5.5
    CVE-2026-25385

    WordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in KaizenCoders URL Shortify url-shortify allows Server Side Request Forgery.This issue affects URL Shortify: from n/a through <= 1.12.3.

    KaizenCoders URL Shortify
  • Medium 5.3
    CVE-2026-25384

    WordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.5.

    WP Lab WP-Lister Lite for eBay
  • Medium 5.3
    CVE-2026-25374

    WordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spa and Salon: from n/a through <= 1.3.2.

    Rara Theme Spa and Salon
  • Medium 6.5
    CVE-2026-25372

    WordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.5.3.

    kodezen Academy LMS
  • Medium 4.3
    CVE-2026-25375

    WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a throug…

    WP Chill Image Photo Gallery Final Tiles Grid
  • Medium 5.3
    CVE-2026-25370

    WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress: from n/a through <= 6.60.28.

    aresit WP Compress
  • Medium 4.3
    CVE-2026-25363

    WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in FooPlugins FooGallery foogallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FooGallery: from n/a through <= 3.1.11.

    FooPlugins FooGallery
  • Medium 5.3
    CVE-2026-25364

    WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.

    Bold Grid Client Invoicing by Sprout Invoices
  • Medium 6.5
    CVE-2026-25368

    WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculated Fields Form: from n/a through <= 5.4.4.1.

    codepeople Calculated Fields Form
  • Medium 5.3
    CVE-2026-25367

    WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through < 3.7.2.

    NooTheme CitiLights