CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- orderable – restaurant & food ordering systemOrderable <= 1.20.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation8.8 High
- walterpinem oneclick chat to orderOneClick Chat to Order <= 1.0.9 - Missing Authorization to Authenticated (Editor+) Plugin Settings Update2.7 Low
- akshayshah5189 remove post type slugRemove Post Type Slug <= 1.0.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- yhunter yamaps for wordpress pluginYaMaps for WordPress <= 0.6.40 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters6.4 Medium
- buddhathemes lizza lms proLizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation9.8 Critical
- ezihosting tennis court bookingsTennis Court Bookings <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parameters4.4 Medium
- paultgoodchild shield: blocks bots, protects users, and prevents security breachesShield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update4.3 Medium
- virusdie – one-click website securityVirusdie <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) API Key Disclosure4.3 Medium
- wpfable shopireShopire <= 1.0.57 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install4.3 Medium
- gagan deep singh postmarkapp email integratorPostmarkApp Email Integrator <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings4.4 Medium
- husainali52 wp audio galleryWP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation8.8 High
- cifi seo plugin by squirrly seo, seo squirrly plugin by squirrly seo +1 moreSEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection4.3 Medium
- icount ixml – google xml sitemap generatoriXML – Google XML sitemap generator <= 0.6 - Reflected Cross-Site Scripting via 'iXML_email' Parameter6.1 Medium
- itthinx groupsGroups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode6.4 Medium
- magazine3 easy table of contentsEasy Table of Contents <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ishitaka xo event calendarXO Event Calendar <= 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode6.4 Medium
- dienodigital page title, description & open graph updaterPage Title, Description & Open Graph Updater <= 1.02 - Cross-Site Request Forgery to Arbitrary Page Title Modification4.3 Medium
- goback2 salavat counter pluginsalavat counter Plugin <= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parameter4.4 Medium
- mtekk breadcrumb navxtBreadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure5.3 Medium
- cloudways breeze cacheBreeze – WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache Deletion5.3 Medium
- apollo13themes apollo13 framework extensionsApollo13 Framework Extension <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter6.4 Medium
- hollandben slidorionSlidorion <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settings4.4 Medium
- themeatelier idonate – blood donation, request and donor management systemIDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function8.8 High
- toret managerToret Manager <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions8.8 High
- wahid0003 product feed manager for woocommerce – ctx feed – support 220+ shopping & social channelsCTX Feed – WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation7.2 High
- franchidesign slider futureSlider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload9.8 Critical
- essentialplugin album and image gallery plus lightboxAlbum and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode6.4 Medium
- iamjaydip advance block extendAdvance Block Extend <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute6.4 Medium
- quadlayers checkout field manager (checkout manager) for woocommerceCheckout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion5.3 Medium
- wp media backwpup – wordpress backup & restore pluginBackWPup <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update7.2 High
- razorpay for woocommerceRazorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification5.3 Medium
- clavaque s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptionss2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- soyrodriguez country blocker for adsenseCountry Blocker for AdSense <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- yehudah xmlrpc attacks blockerxmlrpc attacks blocker <= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For'6.1 Medium
- ss88 uk two factor (2fa) authentication via emailTwo Factor (2FA) Authentication via Email <= 1.9.8 - Two-Factor Authentication Bypass via token6.5 Medium
- openbabel open babelOpen Babel CIF File transform3d.cpp DescribeAsString out-of-bounds5.3 Medium
- xlnt-community xlntxlnt-community xlnt Encrypted XLSX File base64.cpp decode_base64 off-by-one4.8 Medium
- opengamepanel ogp-websiteOGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a...10.0 Critical
- beetel 777vr1Beetel 777VR1 WPA2 PSK hard-coded credentials2.3 Low
- quadlayers checkout field manager (checkout manager) for woocommerceCheckout Field Manager (Checkout Manager) for WooCommerce <= 7.8.1 - Unauthenticated Limited File Upload5.3 Medium
- statcounter – free real time visitor stats, unknown statcounter – free real time visitor stats +1 moreOfficial StatCounter Plugin <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nickname6.4 Medium
- navneil naicker acf photo gallery fieldACF Photo Gallery Field <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Attachment Metadata Modification4.3 Medium
- accessibe web accessibility by accessibeWeb Accessibility by accessiBe <= 2.11 - Unauthenticated Sensitive Information Exposure5.3 Medium
- thinkupthemes rendenRenden <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title6.4 Medium
- monetizemore advanced ads – ad manager & adsenseAdvanced Ads – Ad Manager & AdSense <= 2.0.14 - Missing Authorization to Authenticated (Subscriber+) Ad Placements Update4.3 Medium
- essekia tablesome table – contact form db – wpforms, cf7, gravity, forminator, fluentTablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation8.8 High
- spicethemes newsbloggerNewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation8.8 High
- thinkupthemes driftDrift <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title6.4 Medium
- smartdatasoft clasifico listingClasifico Listing <= 2.0 - Unauthenticated Privilege Escalation9.8 Critical
- owthub library management systemLibrary Management System <= 3.2.1 - Unauthenticated SQL Injection7.5 High
- Show moreLoading…