CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- alobaidi extend linkWordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- wp.insider simple membershipWordPress Simple Membership plugin <= 4.6.9 - Broken Access Control vulnerability4.3 Medium
- 8theme xstore coreWordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- 8theme xstoreWordPress XStore theme <= 9.6.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- shahjahan jewel ninja tablesWordPress Ninja Tables plugin <= 5.2.5 - Sensitive Data Exposure vulnerability4.3 Medium
- 8theme xstoreWordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- n-media frontend file managerWordPress Frontend File Manager plugin <= 23.5 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- creativemindssolutions cm business directoryWordPress CM Business Directory plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- madalin.ungureanu client portalWordPress Client Portal plugin <= 1.2.1 - Broken Access Control vulnerability4.3 Medium
- kraft plugins wheel of lifeWordPress Wheel of Life plugin <= 1.2.0 - Broken Access Control vulnerability5.3 Medium
- almaWordPress Alma plugin <= 5.16.1 - Broken Access Control vulnerability5.3 Medium
- nabil lemsieh hurrytimerWordPress HurryTimer plugin <= 2.14.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wp swings ultimate gift cards for woocommerceWordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability5.3 Medium
- yoren chang media search enhancedWordPress Media Search Enhanced plugin <= 0.9.1 - SQL Injection vulnerability7.6 High
- bbr plugins better business reviewsWordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerability5.4 Medium
- burhan nasir smart auto upload imagesWordPress Smart Auto Upload Images plugin <= 1.2.2 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- magepeopleteam wpeventlyWordPress WpEvently plugin <= 5.1.1 - PHP Object Injection vulnerability9.8 Critical
- designinvento directorypressWordPress DirectoryPress plugin <= 3.6.25 - Broken Access Control vulnerability5.3 Medium
- cmsmasters content composerWordPress CMSMasters Content Composer plugin <= 2.5.8 - Broken Access Control vulnerability7.1 High
- aruba.it dev aruba hispeed cacheWordPress Aruba HiSpeed Cache plugin <= 3.0.4 - Broken Access Control vulnerability6.5 Medium
- codetipi valentiWordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerability8.8 High
- wpdeveloper essential addons for elementorWordPress Essential Addons for Elementor plugin <= 6.5.5 - Broken Access Control vulnerability5.3 Medium
- themegoods grand restaurantWordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability9.8 Critical
- unknown mail mintWordPress Mail Mint plugin <= 1.19.4 - Broken Access Control vulnerability7.5 High
- wpeverest everest formsWordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- yith woocommerce compare, yithemes yith woocommerce compare +1 moreWordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerability7.2 High
- dell powermax, unisphere for powermax +1 moreDell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability....8.1 High
- solidwp ithemes syncWordPress iThemes Sync plugin <= 3.2.8 - Broken Access Control vulnerability4.3 Medium
- dell powermax, unisphere for powermax +1 moreDell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path...6.5 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.10 +3 more +5 moreOrg.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol3.8 Low
- zhutoutoutousan worldquant-minerzhutoutoutousan worldquant-miner URL ssrf_proxy.py server-side request forgery6.3 Medium
- No product listedGithub.com/supranational/blst: blst cryptographic library: denial of service via out-of-bounds stack write in key generation5.3 Medium
- clavaque s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptionss2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover9.8 Critical
- dynamicweb 9Unauthenticated RCE in Dynamicweb 9 and Dynamicweb 810.0 Critical
- No product listedbusy Callback app.js redirect5.1 Medium
- code-projects patient record management systemcode-projects Patient Record Management System fecalysis_not.php sql injection5.3 Medium
- openbabel open babelOpen Babel MOL2 File atom.h SetFormalCharge out-of-bounds5.3 Medium
- talkjsTalkJS <= 0.1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'welcomeMessage' Parameter4.4 Medium
- paultgoodchild shield: blocks bots, protects users, and prevents security breachesShield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection6.5 Medium
- scriptsbundle buyentBuyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration9.8 Critical
- webangon news element elementor blog magazineNews Element Elementor Blog Magazine <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data Loss5.4 Medium
- lawsonry easy author imageEasy Author Image <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Picture URL6.4 Medium
- whatsiplus scheduled notification for woocommerceWhatsiplus Scheduled Notification for Woocommerce <= 1.0.1 - Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX Action4.3 Medium
- levantoan image hotspot by devvnImage Hotspot by DevVN <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Meta6.4 Medium
- prodigy commerce commerce, prodigycommerce prodigy commerce +1 moreProdigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]9.8 Critical
- misbahwp mega store woocommerceMega Store Woocommerce <= 5.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change5.3 Medium
- dealia – request a quoteDealia – Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset4.3 Medium
- paultgoodchild shield: blocks bots, protects users, and prevents security breachesShield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter6.1 Medium
- bompus wp customer reviewsWP Customer Reviews <= 3.7.5 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter7.2 High
- justinkruit advanced custom fields: font awesome fieldAdvanced Custom Fields: Font Awesome <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- Show moreLoading…