CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- cookiebotWordPress Cookiebot plugin <= 4.6.4 - Broken Access Control vulnerability4.3 Medium
- automattic wp job managerWordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability5.3 Medium
- echo plugins knowledge base for documentation, faqs with ai assistanceWordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 16.011.0 - Broken Access Control vulnerability4.3 Medium
- cryout creations serious sliderWordPress Serious Slider plugin <= 1.2.7 - Broken Access Control vulnerability4.3 Medium
- ikreatethemes business royWordPress Business Roy theme <= 1.1.4 - Broken Access Control vulnerability4.3 Medium
- sparklewpthemes fitness fseWordPress Fitness FSE theme <= 1.0.6 - Broken Access Control vulnerability4.3 Medium
- sparklewpthemes hello fseWordPress Hello FSE theme <= 1.0.6 - Broken Access Control vulnerability4.3 Medium
- kaizencoders update urls – quick and easy way to search old links and replace them with new links in wordpressWordPress Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress plugin <= 1.4.0 - Open Redirection vulnerability4.7 Medium
- wp grids wandWordPress WP Wand plugin <= 1.3.07 - Broken Access Control vulnerability5.4 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability5.3 Medium
- scripteo ads proWordPress Ads Pro plugin <= 5.0 - Broken Access Control vulnerability5.4 Medium
- elementor image optimizer by elementorWordPress Image Optimizer by Elementor plugin <= 1.7.1 - Broken Access Control vulnerability4.3 Medium
- elementor allyWordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability5.3 Medium
- kaizencoders url shortifyWordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability5.5 Medium
- wp lab wp-lister lite for ebayWordPress WP-Lister Lite for eBay plugin <= 3.8.5 - Broken Access Control vulnerability5.3 Medium
- nelio software ab testingWordPress Nelio AB Testing plugin <= 8.2.4 - SQL Injection vulnerability7.6 High
- wp chill image photo gallery final tiles gridWordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability4.3 Medium
- rara theme spa and salonWordPress Spa and Salon theme <= 1.3.2 - Broken Access Control vulnerability5.3 Medium
- kodezen llc academy lmsWordPress Academy LMS plugin <= 3.5.3 - Broken Access Control vulnerability6.5 Medium
- aresit wp compressWordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability5.3 Medium
- codepeople calculated fields formWordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability6.5 Medium
- nootheme citilightsWordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability5.3 Medium
- boldgrid client invoicing by sprout invoicesWordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerability5.3 Medium
- fooplugins foogalleryWordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability4.3 Medium
- fooplugins foogalleryWordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- alttextai download alt text aiWordPress Download Alt Text AI plugin <= 1.10.15 - Broken Access Control vulnerability5.3 Medium
- veronalabs wp smsWordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- ays pro ai chatbot with chatgpt and content generator by aysWordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.7.4 - Broken Access Control vulnerability5.3 Medium
- coachifyWordPress Coachify theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- coachifyWordPress Coachify theme <= 1.1.5 - Broken Access Control vulnerability5.3 Medium
- ays pro secure copy content protection and content lockingWordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerability4.3 Medium
- peregrinethemes shopwellWordPress Shopwell theme <= 1.0.11 - Broken Access Control vulnerability5.3 Medium
- fahad mahmood endless posts navigationWordPress Endless Posts Navigation plugin <= 2.2.9 - Broken Access Control vulnerability5.3 Medium
- melapress wp activity logWordPress WP Activity Log plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- publishpress authorsWordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability4.3 Medium
- expresstech systems quiz and survey masterWordPress Quiz And Survey Master plugin <= 10.3.4 - Broken Access Control vulnerability4.3 Medium
- cmsmasters content composerWordPress CMSMasters Content Composer plugin <= 1.4.5 - Local File Inclusion vulnerability7.5 High
- rtcamp rtmedia for wordpress, buddypress and bbpressWordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.8 - Sensitive Data Exposure vulnerability5.3 Medium
- expresstech systems quiz and survey masterWordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- mika osmWordPress OSM plugin <= 6.1.12 - Broken Access Control vulnerability4.3 Medium
- publishpress revisionsWordPress PublishPress Revisions plugin <= 3.7.22 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- psm plugins supportcandyWordPress SupportCandy plugin <= 3.4.4 - Broken Access Control vulnerability5.3 Medium
- cool plugins elementor contact form dbWordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerability5.3 Medium
- wpzita zita elementor site libraryWordPress Zita Elementor Site Library plugin <= 1.6.6 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- wisernotify team wiserreview product reviews for woocommerceWordPress WiserReview Product Reviews for WooCommerce plugin <= 2.9 - Broken Access Control vulnerability4.3 Medium
- brainstorm force cartflowsWordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability7.2 High
- hcaptcha for wpWordPress hCaptcha for WP plugin <= 4.21.1 - Broken Access Control vulnerability5.3 Medium
- wp messiah top table of contentsWordPress TOP Table Of Contents plugin <= 1.3.31 - Broken Access Control vulnerability4.3 Medium
- shahjahan jewel fluentformWordPress FluentForm plugin <= 6.1.14 - Broken Access Control vulnerability4.3 Medium
- 10up autoshare for twitterWordPress Autoshare for Twitter plugin <= 2.3.1 - Broken Access Control vulnerability5.4 Medium
- Show moreLoading…