CVEs published in February 2026
4,804 vulnerabilities, 449 critical, 20 exploited.
- zack katz icontact for gravity formsWordPress iContact for Gravity Forms plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- murtaza bhurgri woo file dropzoneWordPress Woo File Dropzone plugin <= 1.1.7 - Arbitrary File Deletion vulnerability7.7 High
- keeswolters mopinion feedback formWordPress Mopinion Feedback Form plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themeglow jobboard job listingWordPress JobBoard Job listing plugin <= 1.2.8 - Sensitive Data Exposure vulnerability5.9 Medium
- harman79 id arraysWordPress ID Arrays plugin <= 2.1.2 - POST-Based Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- kleor contact managerWordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerability8.8 High
- webmuehle court reservationWordPress Court Reservation plugin <= 1.10.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- anmari amr cron managerWordPress amr cron manager plugin <= 2.3 - Reflecte dCross Site Scripting (XSS) vulnerability7.1 High
- itex isapeWordPress iSape plugin <= 0.72 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- paris holley asynchronous javascriptWordPress Asynchronous Javascript plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- athemeart translations eds responsive menuWordPress eDS Responsive Menu plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- daleab membee loginWordPress Membee Login plugin <= 2.3.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- bas schuiling feedwordpress advanced filtersWordPress FeedWordPress Advanced Filters plugin <= 0.6.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- totalbounty widget logic visualWordPress Widget Logic Visual plugin <= 1.52 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themepul topperpack – complete elementor addons, theme & cpt builderWordPress TopperPack – Complete Elementor Addons, theme & CPT Builder plugin <= 1.2.1 - Local File Inclusion vulnerability7.5 High
- elextensions elex wordpress helpdesk & customer ticketing systemWordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.5 - Broken Access Control vulnerability6.5 Medium
- saiful islam sync master sheet – product sync with google sheet for woocommerceWordPress Sync Master Sheet – Product Sync with Google Sheet for WooCommerce plugin <= 1.1.3 - Broken Access Control vulnerability7.5 High
- sendyWordPress Sendy plugin <= 3.4.2 - Broken Access Control vulnerability6.5 Medium
- webcodingplace woocommerce coming soon product with countdownWordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Local File Inclusion vulnerability7.5 High
- zozothemes wiguardWordPress Wiguard theme < 2.0.1 - Arbitrary File Upload vulnerability9.9 Critical
- thembay nikaWordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerability8.1 High
- thembay dizaWordPress Diza theme <= 1.3.15 - Local File Inclusion vulnerability8.1 High
- vgdevsolutions checkout gateway for irisWordPress Checkout Gateway for IRIS plugin <= 1.3 - Broken Access Control vulnerability6.5 Medium
- boldthemes ippsumWordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability9.8 Critical
- thembay fanaWordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability8.1 High
- thembay zotaWordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerability8.1 High
- add-ons.org pdf for wpformsWordPress PDF for WPForms plugin <= 6.3.0 - Broken Access Control vulnerability6.5 Medium
- modeltheme addons for wpbakery and elementorWordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerability8.8 High
- a wp life modal popup boxWordPress Modal Popup Box plugin <= 1.6.1 - PHP Object Injection vulnerability8.8 High
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- mollie payments for woocommerceWordPress Mollie Payments for WooCommerce plugin <= 8.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wpwax directoristWordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability7.1 High
- shiprocketWordPress Shiprocket plugin <= 2.0.8 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- leadpagesWordPress Leadpages plugin <= 1.1.3 - Broken Access Control vulnerability6.5 Medium
- xlplugins nextmove liteWordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability7.5 High
- lottiefilesWordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerability7.3 High
- travelpayoutsWordPress Travelpayouts plugin <= 1.2.2 - Broken Access Control vulnerability6.5 Medium
- atlas gondal export media urlsWordPress Export Media URLs plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- passionate brains advanced wc analyticsWordPress Advanced WC Analytics plugin <= 3.19.0 - Settings Change vulnerability6.5 Medium
- faraz sms افزونه پیامک حرفه ای فراز اس ام اسWordPress افزونه پیامک حرفه ای فراز اس ام اس plugin <= 2.7.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- passionate brains ga4wp: google analytics for wordpressWordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerability6.5 Medium
- niaj morshed lc wizardWordPress LC Wizard plugin <= 2.1.1 - Settings Change vulnerability6.5 Medium
- addonify floating cart for woocommerceWordPress Addonify Floating Cart For WooCommerce plugin <= 1.2.17 - Broken Access Control vulnerability6.5 Medium
- addonify – woocommerce wishlistWordPress Addonify – WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability6.5 Medium
- addonify – compare products for woocommerceWordPress Addonify – Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerability6.5 Medium
- soporteblue plugin bluex for woocommerceWordPress Plugin BlueX for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability7.3 High
- conveythisWordPress ConveyThis plugin <= 269.9 - Broken Access Control vulnerability6.5 Medium
- themewant easy hotel bookingWordPress Easy Hotel Booking plugin <= 1.9.2 - Broken Access Control vulnerability6.5 Medium
- 100plugins open user mapWordPress Open User Map plugin <= 1.4.16 - Arbitrary File Download vulnerability6.5 Medium
- Show moreLoading…