Skip to content
OpenAdvisories

Archive

February 2026

Vulnerabilities first published in this month (UTC), newest first.

← January 2026 2026 / February March 2026 →
  1. 134
  2. 2158
  3. 3337
  4. 4253
  5. 5119
  6. 6204
  7. 762
  8. 875
  9. 9166
  10. 10282
  11. 11325
  12. 12128
  13. 1368
  14. 14163
  15. 1531
  16. 1688
  17. 17103
  18. 18239
  19. 19397
  20. 20380
  21. 2165
  22. 2259
  23. 2397
  24. 24225
  25. 25239
  26. 26174
  27. 27185
  28. 2818
All Critical High Medium Low Exploited only Public exploit

4,674 results · Feed

  • High 8.1
    CVE-2026-22365

    WordPress Soleng theme <= 1.0.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Soleng soleng allows PHP Local File Inclusion.This issue affects Soleng: from n/a through <= 1.0.5.

    axiomthemes Soleng
  • High 8.1
    CVE-2026-22362

    WordPress Photolia theme <= 1.0.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Photolia photolia allows PHP Local File Inclusion.This issue affects Photolia: from n/a through <= 1.0.3.

    axiomthemes Photolia
  • High 8.1
    CVE-2026-22364

    WordPress SevenTrees theme <=1.0.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes SevenTrees seventrees allows PHP Local File Inclusion.This issue affects SevenTrees: from n/a through <=1.0.2.

    axiomthemes SevenTrees
  • High 7.1
    CVE-2026-22357

    WordPress Link Whisper Free plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through <= 0.9.2.

    Spencer Haws Link Whisper Free
  • High 8.8
    CVE-2026-22354

    WordPress Woocommerce Category Banner Management plugin <= 2.5.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Dotstore Woocommerce Category Banner Management banner-management-for-woocommerce allows Object Injection.This issue affects Woocommerce Category Banner Management: from n/a through <= 2.5.1.

    Dotstore Woocommerce Category Banner Management Web / CMS
  • High 8.1
    CVE-2026-22361

    WordPress A-Mart theme <= 1.0.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes A-Mart a-mart allows PHP Local File Inclusion.This issue affects A-Mart: from n/a through <= 1.0.2.

    axiomthemes A-Mart
  • High 7.5
    CVE-2026-22356

    WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Automattic Jetpack CRM zero-bs-crm allows PHP Local File Inclusion.This issue affects Jetpack CRM: from n/a through <= 6.7.0.

    Automattic Jetpack CRM
  • Medium 6.5
    CVE-2026-22350

    WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for Elementor Forms + Drag And D…

    add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder
  • High 7.1
    CVE-2026-22352

    WordPress Persian Woocommerce SMS plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.1.1.

    PersianScript Persian Woocommerce SMS Web / CMS
  • High 7.5
    CVE-2026-22351

    WordPress WP FullCalendar plugin <= 1.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through <= 1.6.

    Marcus (aka @msykes) WP FullCalendar
  • High 8.8
    CVE-2026-22346

    WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.5.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow slider-responsive-slideshow allows Object Injection.This issue affects Slider Responsive Slideshow – Image slider, Gallery slideshow: fr…

    A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow
  • High 8.1
    CVE-2025-69410

    WordPress Belletrist theme <= 1.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Belletrist belletrist allows PHP Local File Inclusion.This issue affects Belletrist: from n/a through <= 1.2.

    Edge-Themes Belletrist
  • Medium 6.7
    CVE-2026-22341 Public exploit

    WordPress Booked plugin <= 3.0.0 - Account Takeover vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Case-Themes Booked booked allows Authentication Abuse.This issue affects Booked: from n/a through <= 3.0.0.

    Case-Themes Booked
  • High 8.8
    CVE-2026-22345

    WordPress Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin <= 1.6.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery new-image-gallery allows Object Injection.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, M…

    A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery
  • High 8.1
    CVE-2026-22344

    WordPress FiveStar theme <= 1.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes FiveStar fivestar allows PHP Local File Inclusion.This issue affects FiveStar: from n/a through <= 1.7.

    Mikado-Themes FiveStar
  • High 8.1
    CVE-2025-69406

    WordPress FreightCo theme <= 1.1.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX FreightCo freightco allows PHP Local File Inclusion.This issue affects FreightCo: from n/a through <= 1.1.7.

    ThemeREX FreightCo
  • High 8.1
    CVE-2025-69409

    WordPress PJ | Life & Business Coaching theme <= 3.0.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes PJ | Life & Business Coaching pj allows PHP Local File Inclusion.This issue affects PJ | Life & Business Coaching: from n/a th…

    axiomthemes PJ | Life & Business Coaching
  • High 8.1
    CVE-2025-69407

    WordPress Struktur theme <= 2.5.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur struktur allows PHP Local File Inclusion.This issue affects Struktur: from n/a through <= 2.5.1.

    Select-Themes Struktur
  • High 8.1
    CVE-2025-69408

    WordPress HealthFirst theme <= 1.0.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes HealthFirst healthfirst allows PHP Local File Inclusion.This issue affects HealthFirst: from n/a through <= 1.0.1.

    Mikado-Themes HealthFirst
  • Critical 9.8
    CVE-2025-69405

    WordPress Lorem Ipsum | Books & Media Store theme <= 1.2.11 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum | Books & Media Store: from n/a through <= 1.2.11.

    ThemeREX Lorem Ipsum | Books & Media Store
  • High 8.1
    CVE-2025-69400

    WordPress Yokoo theme <= 1.1.11 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yokoo yokoo allows PHP Local File Inclusion.This issue affects Yokoo: from n/a through <= 1.1.11.

    ThemeREX Yokoo
  • High 7.5
    CVE-2025-69401

    WordPress WooODT Lite plugin <= 2.5.2 - Payment Bypass Vulnerability vulnerability

    Authentication Bypass by Spoofing vulnerability in mdalabar WooODT Lite byconsole-woo-order-delivery-time allows Identity Spoofing.This issue affects WooODT Lite: from n/a through <= 2.5.2.

    mdalabar WooODT Lite
  • Critical 9.9
    CVE-2025-69403

    WordPress Bravis Addons plugin <= 1.3.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Bravis-Themes Bravis Addons bravis-addons allows Using Malicious Files.This issue affects Bravis Addons: from n/a through <= 1.3.0.

    Bravis-Themes Bravis Addons
  • Critical 9.8
    CVE-2025-69404

    WordPress Extreme Store theme <= 1.5.10 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a through <= 1.5.10.

    ThemeREX Extreme Store
  • High 8.1
    CVE-2025-69402

    WordPress R&F theme <= 1.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX R&F rf allows PHP Local File Inclusion.This issue affects R&F: from n/a through <= 1.5.

    ThemeREX R&F
  • High 7.5
    CVE-2025-69394

    WordPress Cnvrse plugin < 026.02.10.20 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in cnvrse Cnvrse cnvrse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cnvrse: from n/a through < 026.02.10.20.

    cnvrse Cnvrse
  • High 8.1
    CVE-2025-69399

    WordPress Cobble theme <= 1.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Cobble cobble allows PHP Local File Inclusion.This issue affects Cobble: from n/a through <= 1.7.

    ThemeREX Cobble
  • High 8.1
    CVE-2025-69398

    WordPress Plank theme <= 1.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Plank plank allows PHP Local File Inclusion.This issue affects Plank: from n/a through <= 1.7.

    ThemeREX Plank
  • High 8.1
    CVE-2025-69396

    WordPress Splendour theme <= 1.23 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Splendour splendour allows PHP Local File Inclusion.This issue affects Splendour: from n/a through <= 1.23.

    ThemeREX Splendour
  • High 8.1
    CVE-2025-69397

    WordPress Tint theme <= 1.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tint tint allows PHP Local File Inclusion.This issue affects Tint: from n/a through <= 1.7.

    ThemeREX Tint
  • High 8.1
    CVE-2025-69395

    WordPress Gable theme <= 1.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Gable gable allows PHP Local File Inclusion.This issue affects Gable: from n/a through <= 1.5.

    ThemeREX Gable
  • High 7.1
    CVE-2025-69390

    WordPress Business Template Blocks for WPBakery (Visual Composer) Page Builder plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Business Template Blocks for WPBakery (Visual Composer) Page Builder templates-and-addons-for-wpbakery-page-builder allows Reflected XSS.This issue …

    themebon Business Template Blocks for WPBakery (Visual Composer) Page Builder
  • High 7.5
    CVE-2025-69393

    WordPress Exzo theme <= 1.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jthemes Exzo exzo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exzo: from n/a through <= 1.2.4.

    Jthemes Exzo
  • High 7.1
    CVE-2025-69389

    WordPress Visitor Maps Extended Referer Field plugin <= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hugh Mungus Visitor Maps Extended Referer Field visitor-maps-extended-referer-field allows Reflected XSS.This issue affects Visitor Maps Extended Referer Fie…

    Hugh Mungus Visitor Maps Extended Referer Field
  • High 7.1
    CVE-2025-69391

    WordPress Diamond theme <= 2.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes Diamond diamond allows Reflected XSS.This issue affects Diamond: from n/a through <= 2.4.8.

    gt3themes Diamond
  • High 7.1
    CVE-2025-69392

    WordPress iMoney plugin <= 0.36 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itex iMoney imoney allows Reflected XSS.This issue affects iMoney: from n/a through <= 0.36.

    itex iMoney
  • High 7.1
    CVE-2025-69386

    WordPress RVCFDI para Woocommerce plugin <= 8.1.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realvirtualmx RVCFDI para Woocommerce rvcfdi-para-woocommerce allows Reflected XSS.This issue affects RVCFDI para Woocommerce: from n/a through <= 8.1.8.

    realvirtualmx RVCFDI para Woocommerce Web / CMS
  • High 7.5
    CVE-2025-69387

    WordPress Simple Retail Menus plugin <= 4.2.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in whatwouldjessedo Simple Retail Menus simple-retail-menus allows PHP Local File Inclusion.This issue affects Simple Retail Menus: from n/a …

    whatwouldjessedo Simple Retail Menus
  • High 7.1
    CVE-2025-69384

    WordPress Timeline Event History plugin <= 3.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History timeline-event-history allows Reflected XSS.This issue affects Timeline Event History: from n/a through <= 3.2.

    wpdiscover Timeline Event History
  • Medium 6.5
    CVE-2025-69388

    WordPress Cliengo – Chatbot plugin <= 3.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in cliengo Cliengo – Chatbot cliengo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cliengo – Chatbot: from n/a through <= 3.0.4.

    cliengo Cliengo – Chatbot