Vulnerability database

5,850 results · page 14 of 117

• Feb 20, 2026Membee Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68844 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DaleAB Membee Login membees-member-login-widget allows Reflected XSS.This issue affects Membee Login: from n/a through <= 2.3.6.

  Product

  Membee Login

  Affected

  up to 2.3.6

  What to do

  Affects up to 2.3.6. Update Membee Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026FeedWordPress Advanced Filters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68843 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bas Schuiling FeedWordPress Advanced Filters faf allows Reflected XSS.This issue affects FeedWordPress Advanced Filters: from n/a through <= 0.6.2.

  Product

  FeedWordPress Advanced Filters

  Affected

  up to 0.6.2

  What to do

  Affects up to 0.6.2. Update FeedWordPress Advanced Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Widget Logic Visual: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68842 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalbounty Widget Logic Visual widget-logic-visual allows Reflected XSS.This issue affects Widget Logic Visual: from n/a through <= 1.52.

  Product

  Widget Logic Visual

  Affected

  up to 1.52

  What to do

  Affects up to 1.52. Update Widget Logic Visual to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Mollie Payments for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68501 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mollie Mollie Payments for WooCommerce mollie-payments-for-woocommerce allows Reflected XSS.This issue affects Mollie Payments for WooCommerce: from n/a through <= 8.1.1.

  Product

  Mollie Payments for WooCommerce

  Affected

  up to 8.1.1

  What to do

  Affects up to 8.1.1. Update Mollie Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68495 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.8.0.

  Product

  JetEngine

  Affected

  up to 3.8.0

  What to do

  Affects up to 3.8.0. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Export Media URLs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68037 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atlas Gondal Export Media URLs export-media-urls allows Reflected XSS.This issue affects Export Media URLs: from n/a through <= 2.2.

  Product

  Export Media URLs

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Export Media URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026افزونه پیامک حرفه ای فراز اس ام اس: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68031 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faraz sms افزونه پیامک حرفه ای فراز اس ام اس farazsms allows Reflected XSS.This issue affects افزونه پیامک حرفه ای فراز اس ام اس: from n/a through <= 2.7.3.

  Product

  افزونه پیامک حرفه ای فراز اس ام اس

  Affected

  up to 2.7.3

  What to do

  Affects up to 2.7.3. Update افزونه پیامک حرفه ای فراز اس ام اس to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026User Extra Fields: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67991 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Reflected XSS.This issue affects User Extra Fields: from n/a through <= 16.8.

  Product

  User Extra Fields

  Affected

  up to 16.8

  What to do

  Affects up to 16.8. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026GMap Targeting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67990 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 GMap Targeting gmap-targeting allows Reflected XSS.This issue affects GMap Targeting: from n/a through <= 1.1.7.

  Product

  GMap Targeting

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update GMap Targeting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026NPS computy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67984 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in calliko NPS computy nps-computy allows DOM-Based XSS.This issue affects NPS computy: from n/a through <= 2.8.2.

  Product

  NPS computy

  Affected

  up to 2.8.2

  What to do

  Affects up to 2.8.2. Update NPS computy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Educare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67978 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FixBD Educare educare allows Reflected XSS.This issue affects Educare: from n/a through <= 1.6.1.

  Product

  Educare

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update Educare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026FluentCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67971 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja FluentCart fluent-cart allows Reflected XSS.This issue affects FluentCart: from n/a through < 1.3.0.

  Product

  FluentCart

  What to do

  Update FluentCart to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Silencesoft RSS Reader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60183 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Stored XSS.This issue affects Silencesoft RSS Reader: from n/a through <= 0.6.

  Product

  Silencesoft RSS Reader

  Affected

  up to 0.6

  What to do

  Affects up to 0.6. Update Silencesoft RSS Reader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026WP Wizard Cloak: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53237 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected XSS.This issue affects WP Wizard Cloak: from n/a through <= 1.0.1.

  Product

  WP Wizard Cloak

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update WP Wizard Cloak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Storyform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53233 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RylanH Storyform storyform allows Reflected XSS.This issue affects Storyform: from n/a through <= 0.6.14.

  Product

  Storyform

  Affected

  up to 0.6.14

  What to do

  Affects up to 0.6.14. Update Storyform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Easy Taxonomy Images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53231 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevstudio Easy Taxonomy Images easy-taxonomy-images allows Stored XSS.This issue affects Easy Taxonomy Images: from n/a through <= 1.0.1.

  Product

  Easy Taxonomy Images

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Easy Taxonomy Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026bbpress Simple Advert Units: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53228 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jezza101 bbpress Simple Advert Units bbpress-simple-advert-units allows Reflected XSS.This issue affects bbpress Simple Advert Units: from n/a through <= 0.41.

  Product

  bbpress Simple Advert Units

  Affected

  up to 0.41

  What to do

  Affects up to 0.41. Update bbpress Simple Advert Units to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026NewsMash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56208 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in desertthemes NewsMash newsmash allows Stored XSS.This issue affects NewsMash: from n/a through <= 1.0.71.

  Product

  NewsMash

  Affected

  up to 1.0.71

  What to do

  Affects up to 1.0.71. Update NewsMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52387 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.

  Product

  Master Addons for Elementor

  Affected

  up to 2.0.9.9.4

  What to do

  Affects up to 2.0.9.9.4. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026LiteSpeed Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51915 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.2.

  Product

  LiteSpeed Cache

  Affected

  up to 6.5.2

  What to do

  Affects up to 6.5.2. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Elementor Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50555 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.29.0.

  Product

  Elementor Website Builder

  Affected

  up to 3.29.0

  What to do

  Affects up to 3.29.0. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Nexter Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50452 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Stored XSS.This issue affects Nexter Blocks: from n/a through <= 3.3.3.

  Product

  Nexter Blocks

  Affected

  up to 3.3.3

  What to do

  Affects up to 3.3.3. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27440 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored XSS.This issue affects myCred: from n/a through <= 2.9.7.6.

  Product

  myCred

  Affected

  up to 2.9.7.6

  What to do

  Affects up to 2.9.7.6. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Photo Gallery by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27360 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.38.

  Product

  Photo Gallery by 10Web

  Affected

  up to 1.8.38

  What to do

  Affects up to 1.8.38. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026CoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27094 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoDaddy CoBlocks coblocks allows Stored XSS.This issue affects CoBlocks: from n/a through <= 3.1.16.

  Product

  CoBlocks

  Affected

  up to 3.1.16

  What to do

  Affects up to 3.1.16. Update CoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Shortcoder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27074 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vaakash Shortcoder shortcoder allows Stored XSS.This issue affects Shortcoder: from n/a through <= 6.5.1.

  Product

  Shortcoder

  Affected

  up to 6.5.1

  What to do

  Affects up to 6.5.1. Update Shortcoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Soledad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27069 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad soledad allows DOM-Based XSS.This issue affects Soledad: from n/a through <= 8.7.2.

  Product

  Soledad

  Affected

  up to 8.7.2

  What to do

  Affects up to 8.7.2. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Penci Recipe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27059 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through <= 4.1.

  Product

  Penci Recipe

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update Penci Recipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Penci Podcast: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27058 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Podcast penci-podcast allows DOM-Based XSS.This issue affects Penci Podcast: from n/a through <= 1.7.

  Product

  Penci Podcast

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Penci Podcast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Penci Filter Everything: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27057 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Filter Everything penci-filter-everything allows Stored XSS.This issue affects Penci Filter Everything: from n/a through <= 1.7.

  Product

  Penci Filter Everything

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Penci Filter Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Fusion Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25472 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Stored XSS.This issue affects Fusion Builder: from n/a through <= 3.14.1.

  Product

  Fusion Builder

  Affected

  up to 3.14.1

  What to do

  Affects up to 3.14.1. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Wpresidence Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25463 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate Wpresidence Core wpresidence-core allows Stored XSS.This issue affects Wpresidence Core: from n/a through <= 5.4.0.

  Product

  Wpresidence Core

  Affected

  up to 5.4.0

  What to do

  Affects up to 5.4.0. Update Wpresidence Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Advanced iFrame: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25453 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdempfle Advanced iFrame advanced-iframe allows DOM-Based XSS.This issue affects Advanced iFrame: from n/a through <= 2025.10.

  Product

  Advanced iFrame

  Affected

  up to 2025.10

  What to do

  Affects up to 2025.10. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25451 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.6.9.

  Product

  Bold Page Builder

  Affected

  up to 5.6.9

  What to do

  Affects up to 5.6.9. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Omnipress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25432 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This issue affects Omnipress: from n/a through <= 1.6.7.

  Product

  Omnipress

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026FooGallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25362 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooGallery foogallery allows Stored XSS.This issue affects FooGallery: from n/a through <= 3.1.11.

  Product

  FooGallery

  Affected

  up to 3.1.11

  What to do

  Affects up to 3.1.11. Update FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026WP SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25343 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS wp-sms allows DOM-Based XSS.This issue affects WP SMS: from n/a through <= 7.1.

  Product

  WP SMS

  Affected

  up to 7.1

  What to do

  Affects up to 7.1. Update WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026WP Activity Log: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25331 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n/a through <= 5.5.4.

  Product

  WP Activity Log

  Affected

  up to 5.5.4

  What to do

  Affects up to 5.5.4. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026XStore Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25307 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.7.

  Product

  XStore Core

  What to do

  Update XStore Core to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026XStore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25305 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through <= 9.6.4.

  Product

  XStore

  Affected

  up to 9.6.4

  What to do

  Affects up to 9.6.4. Update XStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026CM Business Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25004 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Business Directory cm-business-directory allows Stored XSS.This issue affects CM Business Directory: from n/a through <= 1.5.3.

  Product

  CM Business Directory

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update CM Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026HurryTimer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24392 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Stored XSS.This issue affects HurryTimer: from n/a through <= 2.14.2.

  Product

  HurryTimer

  Affected

  up to 2.14.2

  What to do

  Affects up to 2.14.2. Update HurryTimer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Shield Security: Cross-Site Request ForgeryCVE-2026-0722 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Shield Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 21.0.8. This is due to the plugin allowing nonce verification to be bypassed via user-supplied parameter in the 'isNonceVerifyRequired' function. This makes it possible for unauthenticated attackers to execute SQL injection attacks, extracting sensitive information from the database, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Shield Security

  Affected

  up to 21.0.8

  What to do

  Affects up to 21.0.8. Update Shield Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 19, 2026Shield Security: Reflected Cross-Site ScriptingCVE-2026-0561 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Shield Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 21.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  Shield Security

  Affected

  up to 21.0.8

  What to do

  Affects up to 21.0.8. Update Shield Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org

• Feb 19, 2026Virusdie - One-click website security: Sensitive Information ExposureCVE-2025-14864 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Virusdie - One-click website security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.7. This is due to missing capability checks on the `vd_get_apikey` function which is hooked to `wp_ajax_virusdie_apikey`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve the site's Virusdie API key, which could be used to access the site owner's Virusdie account and potentially compromise site security.

  Product

  Virusdie - One-click website security

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Virusdie - One-click website security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 19, 2026Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches: Unauthorized modification of dataCVE-2025-14427 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `MfaEmailDisable` action in all versions up to, and including, 21.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the global Email 2FA setting for the entire site.

  Product

  Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches

  Affected

  up to 21.0.9

  What to do

  Affects up to 21.0.9. Update Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 18, 2026Display During Conditional Shortcode: Stored Cross-Site ScriptingCVE-2025-6460 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Display During Conditional Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Display During Conditional Shortcode

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Display During Conditional Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Feb 17, 2026Custom Content by Country (by Shield Security): Missing AuthorizationCVE-2022-41650 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Paul Custom Content by Country (by Shield Security) custom-content-by-country.This issue affects Custom Content by Country (by Shield Security): from n/a through 3.1.2.

  Product

  Custom Content by Country (by Shield Security)

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update Custom Content by Country (by Shield Security) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 17, 2026Frontend File Manager: Allows unauthenticated users to send emails through the site without any security checksCVE-2026-0829 · WordPress plugins & themes · reported by WPScanMedium 5.8

  The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attackers can also guess file IDs to access and share uploaded files without permission, exposing sensitive information.

  Product

  Frontend File Manager

  Affected

  up to 23.5

  What to do

  Affects up to 23.5. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Feb 4, 2026WebPurify Profanity Filter: Unauthorized modification of dataCVE-2026-0572 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The WebPurify Profanity Filter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'webpurify_save_options' function in all versions up to, and including, 4.0.2. This makes it possible for unauthenticated attackers to change plugin settings.

  Product

  WebPurify Profanity Filter

  Affected

  up to 4.0.2

  What to do

  Affects up to 4.0.2. Update WebPurify Profanity Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.