CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- pickplugins testimonial sliderWordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerability6.5 Medium
- kamleshyadav miraculous elementorWordPress Miraculous Elementor plugin <= 2.0.7 - Broken Authentication vulnerability8.8 High
- boldthemes traveliciousWordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability9.8 Critical
- boldthemes nestinWordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability9.8 Critical
- loftocean patiotimeWordPress PatioTime theme < 2.1 - PHP Object Injection vulnerability9.8 Critical
- yaycommerce yaycurrencyWordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerability7.5 High
- vito peleg atarimWordPress Atarim plugin <= 4.2.1 - Broken Access Control vulnerability6.5 Medium
- loftocean patiotimeWordPress PatioTime theme < 2.1 - Local File Inclusion vulnerability8.1 High
- vanquish user extra fieldsWordPress User Extra Fields plugin <= 16.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- realmag777 gmap targetingWordPress GMap Targeting plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- loftocean cozystayWordPress CozyStay theme < 1.9.1 - Local File Inclusion vulnerability8.1 High
- expresstech systems quiz and survey masterWordPress Quiz And Survey Master plugin <= 10.3.1 - SQL Injection vulnerability8.5 High
- calliko nps computyWordPress NPS computy plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- thembay urnaWordPress Urna theme <= 2.5.12 - Local File Inclusion vulnerability8.1 High
- thembay besaWordPress Besa theme <= 2.3.15 - Local File Inclusion vulnerability8.1 High
- thembay haraWordPress Hara theme <= 1.2.17 - Local File Inclusion vulnerability8.1 High
- gsheetconnector by westerndeal wpforms google sheet connectorWordPress WPForms Google Sheet Connector plugin <= 4.0.1 - Remote Code Execution (RCE) vulnerability9.9 Critical
- fixbd educareWordPress Educare plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- villatheme happyWordPress HAPPY plugin <= 1.0.8 - Broken Access Control vulnerability8.2 High
- adirectoryWordPress aDirectory plugin <= 3.0.3 - Broken Access Control vulnerability6.5 Medium
- wp legal pages wplegalpagesWordPress WPLegalPages plugin <= 3.5.4 - Broken Access Control vulnerability7.5 High
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.5.6.2 - Broken Access Control vulnerability6.5 Medium
- zoho mail zeptomailWordPress Zoho ZeptoMail plugin <= 3.2.9 - Broken Access Control vulnerability4.3 Medium
- wpmanageninja fluentcartWordPress FluentCart plugin < 1.3.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- vertim schedulaWordPress Schedula plugin <= 1.0 - Broken Access Control vulnerability5.9 Medium
- knitpay upi qr code payment gateway for woocommerceWordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability6.5 Medium
- arya dhiratara optimize more! – imagesWordPress Optimize More! – Images plugin <= 1.1.3 - Broken Access Control vulnerability6.5 Medium
- uixthemes konteWordPress Konte theme <= 2.4.6 - Broken Access Control vulnerability6.5 Medium
- silence silencesoft rss readerWordPress Silencesoft RSS Reader Plugin <= 0.6 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- nenad obradovic extensive vc addons for wpbakery page builderWordPress Extensive VC Addons for WPBakery page builder plugin <= 1.9.1 - Local File Inclusion vulnerability8.1 High
- soflyy wp wizard cloakWordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability7.1 High
- rylanh storyformWordPress Storyform plugin <= 0.6.14 - Cross Site Scripting (XSS) Vulnerability7.1 High
- wpdevstudio easy taxonomy imagesWordPress Easy Taxonomy Images plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability7.1 High
- jezza101 bbpress simple advert unitsWordPress bbpress Simple Advert Units Plugin <= 0.41 - Cross Site Scripting (XSS) Vulnerability7.1 High
- staviravn aio wp builderWordPress AIO WP Builder Plugin <= 2.0.2 - Broken Access Control Vulnerability7.6 High
- inpersttion for themeWordPress Inpersttion For Theme plugin <= 1.0 - Arbitrary Code Execution vulnerability7.7 High
- desertthemes newsmashWordPress NewsMash theme <= 1.0.71 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- seraphinite solutions accelerator, seraphinitesoft seraphinite accelerator +1 moreWordPress Seraphinite Accelerator plugin <= 2.22.15 - Authenticated Sensitive Data Exposure vulnerability4.3 Medium
- liton arefin master addons for elementorWordPress Master Addons plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- litespeed technologies cache, litespeedtech litespeed cache +1 moreWordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- elementor website builderWordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- posimyth nexter blocksWordPress Nexter Blocks plugin <= 3.3.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- secupress freeWordPress SecuPress Free plugin <= 2.2.5.3 - Broken Access Control vulnerability5.3 Medium
- anssi laitila shared filesWordPress Shared Files plugin <= 1.7.19 - Broken Access Control vulnerability5.3 Medium
docker-stableSUSESecurity update for docker-stableNo scoredocker-stableopenSUSESecurity update for docker-stableNo score- enocean edge inc smartserver iotEnOcean SmartServer IoT Out-of-bounds Read3.7 Low
- enocean edge inc smartserver iotEnOcean SmartServer IoT Command Injection8.1 High
- utt hiper 520, 520 firmware +1 moreUTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injection8.6 High
- utt hiper 520, 520 firmware +1 moreUTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection8.6 High
- Show moreLoading…