Skip to content
OpenAdvisories

Archive

20 February 2026

Vulnerabilities first published on this day (UTC), newest first.

← January 2026 2026 / February /20 March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

380 results · Feed

  • High 8.1
    CVE-2026-22380

    WordPress UnlimHost theme <= 1.2.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes UnlimHost unlimhost allows PHP Local File Inclusion.This issue affects UnlimHost: from n/a through <= 1.2.3.

    AncoraThemes UnlimHost
  • High 8.1
    CVE-2026-22379

    WordPress Netmix theme <= 1.0.10 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Netmix netmix allows PHP Local File Inclusion.This issue affects Netmix: from n/a through <= 1.0.10.

    AncoraThemes Netmix
  • High 8.1
    CVE-2026-22378

    WordPress Blabber theme <= 1.7.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Blabber blabber allows PHP Local File Inclusion.This issue affects Blabber: from n/a through <= 1.7.0.

    AncoraThemes Blabber
  • High 8.1
    CVE-2026-22381

    WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows PHP Local File Inclusion.This issue affects PawFriend…

    Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme Web / CMS
  • High 7.5
    CVE-2026-22383

    WordPress PawFriends - Pet Shop and Veterinary WordPress theme theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PawFriends - Pet Shop an…

    Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme Web / CMS
  • High 8.1
    CVE-2026-22377

    WordPress Saveo theme <= 1.1.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Saveo saveo allows PHP Local File Inclusion.This issue affects Saveo: from n/a through <= 1.1.2.

    AncoraThemes Saveo
  • High 8.1
    CVE-2026-22373

    WordPress Fooddy theme <= 1.3.10 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Fooddy fooddy allows PHP Local File Inclusion.This issue affects Fooddy: from n/a through <= 1.3.10.

    AncoraThemes Fooddy
  • High 8.1
    CVE-2026-22374

    WordPress Zio Alberto theme <= 1.2.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Zio Alberto zioalberto allows PHP Local File Inclusion.This issue affects Zio Alberto: from n/a through <= 1.2.2.

    AncoraThemes Zio Alberto
  • High 8.1
    CVE-2026-22375

    WordPress Impacto Patronus theme <= 1.2.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Impacto Patronus impacto-patronus allows PHP Local File Inclusion.This issue affects Impacto Patronus: from n/a through <= 1.…

    AncoraThemes Impacto Patronus
  • High 8.1
    CVE-2026-22376

    WordPress Parkivia theme <= 1.1.9 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Parkivia parkivia allows PHP Local File Inclusion.This issue affects Parkivia: from n/a through <= 1.1.9.

    AncoraThemes Parkivia
  • High 8.1
    CVE-2026-22371

    WordPress Gustavo theme <= 1.2.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Gustavo gustavo allows PHP Local File Inclusion.This issue affects Gustavo: from n/a through <= 1.2.2.

    AncoraThemes Gustavo
  • High 8.1
    CVE-2026-22372

    WordPress Isida theme <= 1.4.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Isida isida allows PHP Local File Inclusion.This issue affects Isida: from n/a through <= 1.4.2.

    AncoraThemes Isida
  • High 8.1
    CVE-2026-22368

    WordPress Redy theme <= 1.0.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Redy redy allows PHP Local File Inclusion.This issue affects Redy: from n/a through <= 1.0.2.

    axiomthemes Redy
  • High 8.1
    CVE-2026-22366

    WordPress Jude theme <= 1.3.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Jude jude allows PHP Local File Inclusion.This issue affects Jude: from n/a through <= 1.3.0.

    axiomthemes Jude
  • High 8.1
    CVE-2026-22369

    WordPress Ironfit theme <= 1.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Ironfit ironfit allows PHP Local File Inclusion.This issue affects Ironfit: from n/a through <= 1.5.

    AncoraThemes Ironfit
  • High 8.1
    CVE-2026-22370

    WordPress Marveland theme <= 1.3.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Marveland marveland allows PHP Local File Inclusion.This issue affects Marveland: from n/a through <= 1.3.0.

    axiomthemes Marveland
  • High 8.1
    CVE-2026-22367

    WordPress Coworking theme <= 1.6.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Coworking coworking allows PHP Local File Inclusion.This issue affects Coworking: from n/a through <= 1.6.1.

    AncoraThemes Coworking
  • High 8.1
    CVE-2026-22363

    WordPress Rhodos theme <= 1.3.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Rhodos rhodos allows PHP Local File Inclusion.This issue affects Rhodos: from n/a through <= 1.3.3.

    axiomthemes Rhodos
  • High 8.1
    CVE-2026-22365

    WordPress Soleng theme <= 1.0.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Soleng soleng allows PHP Local File Inclusion.This issue affects Soleng: from n/a through <= 1.0.5.

    axiomthemes Soleng
  • High 8.1
    CVE-2026-22362

    WordPress Photolia theme <= 1.0.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Photolia photolia allows PHP Local File Inclusion.This issue affects Photolia: from n/a through <= 1.0.3.

    axiomthemes Photolia
  • High 8.1
    CVE-2026-22364

    WordPress SevenTrees theme <=1.0.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes SevenTrees seventrees allows PHP Local File Inclusion.This issue affects SevenTrees: from n/a through <=1.0.2.

    axiomthemes SevenTrees
  • High 7.1
    CVE-2026-22357

    WordPress Link Whisper Free plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through <= 0.9.2.

    Spencer Haws Link Whisper Free
  • High 8.8
    CVE-2026-22354

    WordPress Woocommerce Category Banner Management plugin <= 2.5.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Dotstore Woocommerce Category Banner Management banner-management-for-woocommerce allows Object Injection.This issue affects Woocommerce Category Banner Management: from n/a through <= 2.5.1.

    Dotstore Woocommerce Category Banner Management Web / CMS
  • High 8.1
    CVE-2026-22361

    WordPress A-Mart theme <= 1.0.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes A-Mart a-mart allows PHP Local File Inclusion.This issue affects A-Mart: from n/a through <= 1.0.2.

    axiomthemes A-Mart
  • High 7.5
    CVE-2026-22356

    WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Automattic Jetpack CRM zero-bs-crm allows PHP Local File Inclusion.This issue affects Jetpack CRM: from n/a through <= 6.7.0.

    Automattic Jetpack CRM
  • Medium 6.5
    CVE-2026-22350

    WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for Elementor Forms + Drag And D…

    add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder
  • High 7.1
    CVE-2026-22352

    WordPress Persian Woocommerce SMS plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.1.1.

    PersianScript Persian Woocommerce SMS Web / CMS
  • High 7.5
    CVE-2026-22351

    WordPress WP FullCalendar plugin <= 1.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through <= 1.6.

    Marcus (aka @msykes) WP FullCalendar
  • High 8.8
    CVE-2026-22346

    WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.5.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow slider-responsive-slideshow allows Object Injection.This issue affects Slider Responsive Slideshow – Image slider, Gallery slideshow: fr…

    A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow
  • High 8.1
    CVE-2025-69410

    WordPress Belletrist theme <= 1.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Belletrist belletrist allows PHP Local File Inclusion.This issue affects Belletrist: from n/a through <= 1.2.

    Edge-Themes Belletrist
  • Medium 6.7
    CVE-2026-22341 Public exploit

    WordPress Booked plugin <= 3.0.0 - Account Takeover vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Case-Themes Booked booked allows Authentication Abuse.This issue affects Booked: from n/a through <= 3.0.0.

    Case-Themes Booked
  • High 8.8
    CVE-2026-22345

    WordPress Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin <= 1.6.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery new-image-gallery allows Object Injection.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, M…

    A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery
  • High 8.1
    CVE-2026-22344

    WordPress FiveStar theme <= 1.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes FiveStar fivestar allows PHP Local File Inclusion.This issue affects FiveStar: from n/a through <= 1.7.

    Mikado-Themes FiveStar
  • High 8.1
    CVE-2025-69406

    WordPress FreightCo theme <= 1.1.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX FreightCo freightco allows PHP Local File Inclusion.This issue affects FreightCo: from n/a through <= 1.1.7.

    ThemeREX FreightCo
  • High 8.1
    CVE-2025-69409

    WordPress PJ | Life & Business Coaching theme <= 3.0.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes PJ | Life & Business Coaching pj allows PHP Local File Inclusion.This issue affects PJ | Life & Business Coaching: from n/a th…

    axiomthemes PJ | Life & Business Coaching
  • High 8.1
    CVE-2025-69407

    WordPress Struktur theme <= 2.5.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur struktur allows PHP Local File Inclusion.This issue affects Struktur: from n/a through <= 2.5.1.

    Select-Themes Struktur
  • High 8.1
    CVE-2025-69408

    WordPress HealthFirst theme <= 1.0.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes HealthFirst healthfirst allows PHP Local File Inclusion.This issue affects HealthFirst: from n/a through <= 1.0.1.

    Mikado-Themes HealthFirst
  • Critical 9.8
    CVE-2025-69405

    WordPress Lorem Ipsum | Books & Media Store theme <= 1.2.11 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum | Books & Media Store: from n/a through <= 1.2.11.

    ThemeREX Lorem Ipsum | Books & Media Store
  • High 8.1
    CVE-2025-69400

    WordPress Yokoo theme <= 1.1.11 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yokoo yokoo allows PHP Local File Inclusion.This issue affects Yokoo: from n/a through <= 1.1.11.

    ThemeREX Yokoo
  • High 7.5
    CVE-2025-69401

    WordPress WooODT Lite plugin <= 2.5.2 - Payment Bypass Vulnerability vulnerability

    Authentication Bypass by Spoofing vulnerability in mdalabar WooODT Lite byconsole-woo-order-delivery-time allows Identity Spoofing.This issue affects WooODT Lite: from n/a through <= 2.5.2.

    mdalabar WooODT Lite