Skip to content
OpenAdvisories

Archive

February 2026

Vulnerabilities first published in this month (UTC), newest first.

← January 2026 2026 / February March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

1,979 results · Clear filters · Feed

  • Medium 5.9
    CVE-2025-68855

    WordPress JobBoard Job listing plugin <= 1.2.8 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in themeglow JobBoard Job listing job-board-light allows Retrieve Embedded Sensitive Data.This issue affects JobBoard Job listing: from n/a through <= 1.2.8.

    themeglow JobBoard Job listing
  • Medium 6.5
    CVE-2025-68564

    WordPress Sendy plugin <= 3.4.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sendy Sendy sendy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendy: from n/a through <= 3.4.2.

    sendy Sendy
  • Medium 6.5
    CVE-2025-68837

    WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WordPress Help…

    ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System Web / CMS
  • Medium 6.5
    CVE-2025-68542

    WordPress Checkout Gateway for IRIS plugin <= 1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Gateway for IRIS: from n/a through <= 1.3.

    vgdevsolutions Checkout Gateway for IRIS
  • Medium 6.5
    CVE-2025-68534

    WordPress PDF for WPForms plugin <= 6.3.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 6.3.0.

    add-ons.org PDF for WPForms
  • Medium 6.5
    CVE-2025-68514

    WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a thr…

    Cozmoslabs Paid Member Subscriptions
  • Medium 6.5
    CVE-2025-68050

    WordPress Leadpages plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Leadpages Leadpages leadpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadpages: from n/a through <= 1.1.3.

    Leadpages Leadpages
  • Medium 6.5
    CVE-2025-68028

    WordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GA4WP: Google Analytics for WordPress: from n/a through <= 2.10…

    Passionate Brains GA4WP: Google Analytics for WordPress Web / CMS
  • Medium 6.5
    CVE-2025-68042

    WordPress Travelpayouts plugin <= 1.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Travelpayouts Travelpayouts travelpayouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelpayouts: from n/a through <= 1.2.2.

    Travelpayouts Travelpayouts
  • Medium 6.5
    CVE-2025-68032

    WordPress Advanced WC Analytics plugin <= 3.19.0 - Settings Change vulnerability

    Missing Authorization vulnerability in Passionate Brains Advanced WC Analytics advance-wc-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced WC Analytics: from n/a through <= 3.19.0.

    Passionate Brains Advanced WC Analytics
  • Medium 6.5
    CVE-2025-68025

    WordPress Addonify Floating Cart For WooCommerce plugin <= 1.2.17 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Addonify Addonify Floating Cart For WooCommerce addonify-floating-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify Floating Cart For WooCommerce: from n/a through <…

    Addonify Addonify Floating Cart For WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68026

    WordPress LC Wizard plugin <= 2.1.1 - Settings Change vulnerability

    Missing Authorization vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LC Wizard: from n/a through <= 2.1.1.

    Niaj Morshed LC Wizard
  • Medium 6.5
    CVE-2025-68024

    WordPress Addonify – WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability

    Missing Authorization vulnerability in Addonify Addonify – WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – WooCommerce Wishlist: from n/a through <= 2.0.15.

    Addonify Addonify – WooCommerce Wishlist Web / CMS
  • Medium 6.5
    CVE-2025-68023

    WordPress Addonify – Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerability

    Missing Authorization vulnerability in Addonify Addonify – Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – Compare Products For WooCommerce: from …

    Addonify Addonify – Compare Products For WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68005

    WordPress Easy Hotel Booking plugin <= 1.9.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themewant Easy Hotel Booking easy-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Hotel Booking: from n/a through <= 1.9.2.

    themewant Easy Hotel Booking
  • Medium 6.5
    CVE-2025-68002

    WordPress Open User Map plugin <= 1.4.16 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 100plugins Open User Map open-user-map allows Path Traversal.This issue affects Open User Map: from n/a through <= 1.4.16.

    100plugins Open User Map
  • Medium 6.5
    CVE-2025-68021

    WordPress ConveyThis plugin <= 269.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ConveyThis: from n/a through <= 269.9.

    ConveyThis ConveyThis
  • Medium 6.5
    CVE-2025-68000

    WordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.

    PickPlugins Testimonial Slider
  • Medium 6.5
    CVE-2025-67993

    WordPress Atarim plugin <= 4.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.2.1.

    Vito Peleg Atarim
  • Medium 6.5
    CVE-2025-67975

    WordPress aDirectory plugin <= 3.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in aDirectory aDirectory adirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects aDirectory: from n/a through <= 3.0.3.

    aDirectory aDirectory
  • Medium 4.3
    CVE-2025-67972

    WordPress Zoho ZeptoMail plugin <= 3.2.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zoho ZeptoMail: from n/a through 3.2.9.

    Zoho Mail Zoho ZeptoMail
  • Medium 6.5
    CVE-2025-67973

    WordPress Sunshine Photo Cart plugin <= 3.5.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2.

    sunshinephotocart Sunshine Photo Cart
  • Medium 5.9
    CVE-2025-67970

    WordPress Schedula plugin <= 1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vertim Schedula schedula-smart-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schedula: from n/a through <= 1.0.

    vertim Schedula
  • Medium 6.5
    CVE-2025-67624

    WordPress Optimize More! – Images plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Arya Dhiratara Optimize More! – Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! – Images: from n/a through <= 1.1.3.

    Arya Dhiratara Optimize More! – Images
  • Medium 6.5
    CVE-2025-67969

    WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommer…

    Knit Pay UPI QR Code Payment Gateway for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-67547

    WordPress Konte theme <= 2.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in uixthemes Konte konte allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Konte: from n/a through <= 2.4.6.

    uixthemes Konte
  • Medium 5.9
    CVE-2025-60183

    WordPress Silencesoft RSS Reader Plugin <= 0.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Stored XSS.This issue affects Silencesoft RSS Reader: from n/a through <= 0.6.

    silence Silencesoft RSS Reader
  • Medium 6.5
    CVE-2024-56208

    WordPress NewsMash theme <= 1.0.71 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in desertthemes NewsMash newsmash allows Stored XSS.This issue affects NewsMash: from n/a through <= 1.0.71.

    desertthemes NewsMash
  • Medium 6.5
    CVE-2024-50555

    WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.29.0.

    Elementor Elementor Website Builder
  • Medium 6.5
    CVE-2024-50452

    WordPress Nexter Blocks plugin <= 3.3.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Stored XSS.This issue affects Nexter Blocks: from n/a through <= 3.3.3.

    POSIMYTH Nexter Blocks
  • Medium 5.9
    CVE-2024-52387

    WordPress Master Addons plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.

    Liton Arefin Master Addons for Elementor
  • Medium 6.5
    CVE-2024-51915

    WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.2.

    LiteSpeed Technologies LiteSpeed Cache
  • Medium 4.3
    CVE-2024-54222

    WordPress Seraphinite Accelerator plugin <= 2.22.15 - Authenticated Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator allows Retrieve Embedded Sensitive Data.This issue affects Seraphinite Accelerator: from n/a through <= 2.22.15.

    Seraphinite Solutions Seraphinite Accelerator
  • Medium 5.3
    CVE-2024-34438

    WordPress Shared Files plugin <= 1.7.19 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19.

    Anssi Laitila Shared Files
  • Medium 5.3
    CVE-2024-43228

    WordPress SecuPress Free plugin <= 2.2.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SecuPress SecuPress Free secupress.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.

    SecuPress SecuPress Free
  • Medium 6.4
    CVE-2026-2486

    Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'

    The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_table_btn_text' parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it pos…

    litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Web / CMS
  • Medium 6.5
    CVE-2025-59819

    Authenticated Arbitrary File Read via filepath parameter

    This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path.

    Zenitel alphacom_xe_audio_server
  • Medium 6.1
    CVE-2026-26370

    WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. If this vulner…

    Ays Pro Survey Maker Web / CMS
  • Medium 6.3
    CVE-2026-2824 EPSS 17%

    Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection

    A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET&section=ping_config of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection.…

    Comfast CF-E7
  • Medium 6.3
    CVE-2026-2823 EPSS 19%

    Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection

    A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in com…

    Comfast CF-E7