CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- linux, linux kernel +1 moremISDN: annotate data-race around dev->work5.5 Medium
- linux, linux kernel +1 morel2tp: avoid one data-race in l2tp_tunnel_del_work()5.5 Medium
- linux, linux kernel +1 morebonding: provide a net pointer to __skb_flow_dissect()5.5 Medium
- linux, linux kernel +1 morerxrpc: Fix data-race warning and potential load/store tearing4.7 Medium
- linux, linux kernel +1 moreice: add missing ice_deinit_hw() in devlink reinit path5.5 Medium
- linux, linux kernel +1 morepmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu5.5 Medium
- linux, linux kernel +1 moreserial: Fix not set tty->port race condition4.7 Medium
- linux, linux kernel +1 morearm64/fpsimd: ptrace: Fix SVE writes on !SME systems5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moreio_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop5.5 Medium
- linux, linux kernel +1 moremmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode5.5 Medium
- maxfoundry media library foldersMedia Library Folders <= 8.3.6 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename4.3 Medium
- wpdevteam essential addons for elementor – popular elementor templates & widgetsEssential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget6.4 Medium
- getwpfunnels mail mint – email marketing, newsletter, email automation & woocommerce emailsMail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints4.9 Medium
- optimole super page cacheSuper Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Log7.2 High
- saadiqbal points management system for gamification, ranks, badges, and loyalty rewards program – mycredmyCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode6.4 Medium
- dreamstechnologies truelysell coreTruelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration9.8 Critical
- wpchill modula image gallery – photo grid & video galleryModula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing4.3 Medium
- sonaar mp3 audio player – music player, podcast player & radio by sonaarMP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery5.0 Medium
- wpdecent flexi product slider and grid for woocommerceFlexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute7.5 High
- morelmathieuj scheduler widgetScheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification5.4 Medium
- bestony simple plyrSimple Plyr <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute6.4 Medium
- terrazoom zoomifywp freeZoomifyWP Free <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute6.4 Medium
- collectchat chatbot for wordpress by collect.chat ⚡️Chatbot for WordPress by Collect.chat ⚡️ <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Field6.4 Medium
- arieslab press3dPress3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block6.4 Medium
- bitacre super simple contact formSuper Simple Contact Form <= 1.6.2 - Reflected Cross-Site Scripting via 'sscf_name' Parameter7.2 High
- adminkov midi-synthmidi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action9.8 Critical
- webilop user language switchUser Language Switch <= 1.6.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab_color_picker_language_switch' Parameter4.4 Medium
- ajferg link hopperLink Hopper <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' Parameter4.4 Medium
- upmenu – online ordering for restaurantsUpMenu <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute6.4 Medium
- matthieuscarset mailchimp campaignsMailChimp Campaigns <= 3.2.4 - Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection5.3 Medium
- raju ahmed best-wp-google-mapBest-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute6.4 Medium
- arnoesterhuizen allow html in category descriptionsAllow HTML in Category Descriptions <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions4.4 Medium
- stylemix masterstudy lms wordpress plugin – for online courses and educationMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode6.4 Medium
- devmw sphere managerSphere Manager <= 1.0.2 - Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute6.4 Medium
- dmitritechs wp quick contact usWP Quick Contact Us <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- krellbat callbackkiller service widgetCallbackKiller service widget <= 1.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update5.3 Medium
- peterschulznl wp data access – app builder for tables, forms, charts, maps & dashboardsWP Data Access <= 5.5.63 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode6.4 Medium
- antevenio mdirector newsletter wordpress pluginMDirector Newsletter <= 4.5.8 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- savitasoni photostack galleryPhotoStack Gallery <= 0.4.1 - Unauthenticated SQL Injection via 'postid' Parameter7.5 High
- cutesalah percent to infographPercent to Infograph <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- sivenso address bar adsAddress Bar Ads <= 1.0.0 - Reflected Cross-Site Scripting6.1 Medium
- shellbot ravelry designs widgetRavelry Designs Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb_ravelry_designs' Shortcode 'layout' Attribute6.4 Medium
- owencutajar geo widgetGeo Widet <= 1.0 - Reflected Cross-Site Scripting6.1 Medium
- edgarrojas smart forms – when you need more than just a contact formSmart Forms <= 2.6.99 - Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure4.3 Medium
- questionpro surveysQuestionPro Surveys <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- webilop user language switchUser Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter5.5 Medium
- brandonfire payment page | payment form for stripePayment Page | Payment Form for Stripe <= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' Parameter6.4 Medium
- essentialplugin accordion and accordion sliderAccordion and Accordion Slider <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification5.4 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery4.3 Medium
- amentotechpvtltd one to one user chat by wpguppyOne to one user Chat by WPGuppy <= 1.1.4 - Unauthenticated Information Disclosure via Chat Message Interception5.3 Medium
- Show moreLoading…