Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,725 results · page 193 of 815
Feb 20, 2026Cartify - WooCommerce Gutenberg: Missing AuthorizationCVE-2025-69385 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AgniHD Cartify - WooCommerce Gutenberg WordPress Theme cartify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cartify - WooCommerce Gutenberg WordPress Theme: from n/a through <= 1.3.
- Product
- Cartify - WooCommerce Gutenberg
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Cartify - WooCommerce Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Timeline Event History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69384 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History timeline-event-history allows Reflected XSS.This issue affects Timeline Event History: from n/a through <= 3.2.
- Product
- Timeline Event History
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update Timeline Event History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026WP shop: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69383 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Agence web Eoxia - Montpellier WP shop wpshop allows PHP Local File Inclusion.This issue affects WP shop: from n/a through <= 2.6.1.
- Product
- WP shop
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update WP shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Themesflat Elementor: Deserialization of Untrusted DataCVE-2025-69382 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themesflat Themesflat Elementor themesflat-elementor allows Object Injection.This issue affects Themesflat Elementor: from n/a through <= 1.0.1.
- Product
- Themesflat Elementor
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Themesflat Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026WooCommerce Bulk Product Editor: Missing AuthorizationCVE-2025-69381 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0.
- Product
- WooCommerce Bulk Product Editor
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WooCommerce Bulk Product Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Upload Files Anywhere: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69380 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.
- Product
- Upload Files Anywhere
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Upload Files Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Upload Files Anywhere: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69379 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.
- Product
- Upload Files Anywhere
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Upload Files Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Product Filter for WooCommerce: Incorrect Privilege AssignmentCVE-2025-69378 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in XforWooCommerce Product Filter for WooCommerce prdctfltr allows Privilege Escalation.This issue affects Product Filter for WooCommerce: from n/a through <= 9.1.2.
- Product
- Product Filter for WooCommerce
- Affected
- up to 9.1.2
- What to do
- Affects up to 9.1.2. Update Product Filter for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026User Extra Fields: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69377 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.
- Product
- User Extra Fields
- Affected
- up to 17.0
- What to do
- Affects up to 17.0. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026User Extra Fields: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69376 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.
- Product
- User Extra Fields
- Affected
- up to 17.0
- What to do
- Affects up to 17.0. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Portfolio Builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69375 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SolverWp Portfolio Builder swp-portfolio allows PHP Local File Inclusion.This issue affects Portfolio Builder: from n/a through <= 1.2.5.
- Product
- Portfolio Builder
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Portfolio Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Eleblog – Elementor Blog And Magazine Addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69374 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SolverWp Eleblog – Elementor Blog And Magazine Addons ele-blog allows PHP Local File Inclusion.This issue affects Eleblog – Elementor Blog And Magazine Addons: from n/a through <= 2.0.3.
- Product
- Eleblog – Elementor Blog And Magazine Addons
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Eleblog – Elementor Blog And Magazine Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026VidoRev: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69373 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 VidoRev vidorev allows PHP Local File Inclusion.This issue affects VidoRev: from n/a through <= 2.9.9.9.9.9.7.
- Product
- VidoRev
- Affected
- up to 2.9.9.9.9.9.7
- What to do
- Affects up to 2.9.9.9.9.9.7. Update VidoRev to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026SevenHills: Deserialization of Untrusted DataCVE-2025-69372 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes SevenHills sevenhills allows Object Injection.This issue affects SevenHills: from n/a through <= 1.6.2.
- Product
- SevenHills
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update SevenHills to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026KindlyCare: Deserialization of Untrusted DataCVE-2025-69371 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes KindlyCare kindlycare allows Object Injection.This issue affects KindlyCare: from n/a through <= 1.6.1.
- Product
- KindlyCare
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update KindlyCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Capella: Deserialization of Untrusted DataCVE-2025-69370 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.
- Product
- Capella
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update Capella to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026SOHO - Photography: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69368 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes SOHO - Photography WordPress Theme soho allows DOM-Based XSS.This issue affects SOHO - Photography WordPress Theme: from n/a through <= 3.0.3.
- Product
- SOHO - Photography
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update SOHO - Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Oyster - Photography: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69367 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes Oyster - Photography WordPress Theme oyster allows DOM-Based XSS.This issue affects Oyster - Photography WordPress Theme: from n/a through <= 4.4.3.
- Product
- Oyster - Photography
- Affected
- up to 4.4.3
- What to do
- Affects up to 4.4.3. Update Oyster - Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Emerce Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69366 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Emerce Core emerce-core allows Blind SQL Injection.This issue affects Emerce Core: from n/a through <= 1.8.
- Product
- Emerce Core
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Emerce Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Uroan Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69365 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Uroan Core uroan-core allows Blind SQL Injection.This issue affects Uroan Core: from n/a through <= 1.4.4.
- Product
- Uroan Core
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Uroan Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Wolmart Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69337 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Wolmart Core wolmart-core allows Blind SQL Injection.This issue affects Wolmart Core: from n/a through <= 1.9.6.
- Product
- Wolmart Core
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update Wolmart Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Prestige: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69330 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Prestige prestige allows Reflected XSS.This issue affects Prestige: from n/a through < 1.4.1.
- Product
- Prestige
- What to do
- Update Prestige to the newest version.
Feb 20, 2026Prestige: Deserialization of Untrusted DataCVE-2025-69329 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Jthemes Prestige prestige allows Object Injection.This issue affects Prestige: from n/a through < 1.4.1.
- Product
- Prestige
- What to do
- Update Prestige to the newest version.
Feb 20, 2026Booking and Rental Manager: Deserialization of Untrusted DataCVE-2025-69328 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.9.
- Product
- Booking and Rental Manager
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026NEX-Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69326 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through <= 9.1.7.
- Product
- NEX-Forms
- Affected
- up to 9.1.7
- What to do
- Affects up to 9.1.7. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Primer MyData for Woocommerce: Path Traversal: '.../...//'CVE-2025-69325 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Path Traversal: '.../...//' vulnerability in primersoftware Primer MyData for Woocommerce primer-mydata allows Path Traversal.This issue affects Primer MyData for Woocommerce: from n/a through <= 4.2.8.
- Product
- Primer MyData for Woocommerce
- Affected
- up to 4.2.8
- What to do
- Affects up to 4.2.8. Update Primer MyData for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026NEX-Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69324 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Stored XSS.This issue affects NEX-Forms: from n/a through <= 9.1.7.
- Product
- NEX-Forms
- Affected
- up to 9.1.7
- What to do
- Affects up to 9.1.7. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Slimstat Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69323 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs Slimstat Analytics wp-slimstat allows Reflected XSS.This issue affects Slimstat Analytics: from n/a through <= 5.3.2.
- Product
- Slimstat Analytics
- Affected
- up to 5.3.2
- What to do
- Affects up to 5.3.2. Update Slimstat Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026PeakShops: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69322 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes PeakShops peakshops allows PHP Local File Inclusion.This issue affects PeakShops: from n/a through < 1.5.9.
- Product
- PeakShops
- What to do
- Update PeakShops to the newest version.
Feb 20, 2026Woodly Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69310 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Woodly Core woodly-core allows Blind SQL Injection.This issue affects Woodly Core: from n/a through <= 1.4.
- Product
- Woodly Core
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Woodly Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Saasplate Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69309 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Saasplate Core saasplate-core allows Blind SQL Injection.This issue affects Saasplate Core: from n/a through <= 1.2.8.
- Product
- Saasplate Core
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Saasplate Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Nestbyte Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69308 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Nestbyte Core nestbyte-core allows Blind SQL Injection.This issue affects Nestbyte Core: from n/a through <= 1.2.
- Product
- Nestbyte Core
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Nestbyte Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Medinik Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69307 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Medinik Core medinik-core allows Blind SQL Injection.This issue affects Medinik Core: from n/a through <= 1.3.6.
- Product
- Medinik Core
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update Medinik Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Electio Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69306 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Electio Core electio-core allows Blind SQL Injection.This issue affects Electio Core: from n/a through <= 1.4.
- Product
- Electio Core
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Electio Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Crete Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69305 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Crete Core crete-core allows Blind SQL Injection.This issue affects Crete Core: from n/a through <= 1.4.3.
- Product
- Crete Core
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Crete Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Allmart: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69304 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Allmart allmart-core allows Blind SQL Injection.This issue affects Allmart: from n/a through <= 1.1.
- Product
- Allmart
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Allmart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026ModelTheme Framework: Missing AuthorizationCVE-2025-69303 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in modeltheme ModelTheme Framework modeltheme-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ModelTheme Framework: from n/a through < 2.0.0.
- Product
- ModelTheme Framework
- What to do
- Update ModelTheme Framework to the newest version.
Feb 20, 2026DesignThemes Core Features: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69302 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through <= 2.3.
- Product
- DesignThemes Core Features
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update DesignThemes Core Features to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026PhotoMe: Deserialization of Untrusted DataCVE-2025-69301 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.
- Product
- PhotoMe
- Affected
- up to 5.6.11
- What to do
- Affects up to 5.6.11. Update PhotoMe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Oxygen: Server-Side Request Forgery (SSRF)CVE-2025-69299 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in Laborator Oxygen oxygen allows Server Side Request Forgery.This issue affects Oxygen: from n/a through <= 6.0.8.
- Product
- Oxygen
- Affected
- up to 6.0.8
- What to do
- Affects up to 6.0.8. Update Oxygen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Gauge: Missing AuthorizationCVE-2025-69298 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in GhostPool Gauge gauge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gauge: from n/a through <= 6.56.4.
- Product
- Gauge
- Affected
- up to 6.56.4
- What to do
- Affects up to 6.56.4. Update Gauge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Aardvark: Missing AuthorizationCVE-2025-69297 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in GhostPool Aardvark Plugin aardvark-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aardvark Plugin: from n/a through <= 2.19.
- Product
- Aardvark
- Affected
- up to 2.19
- What to do
- Affects up to 2.19. Update Aardvark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Aardvark: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69296 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhostPool Aardvark aardvark allows Reflected XSS.This issue affects Aardvark: from n/a through <= 4.6.3.
- Product
- Aardvark
- Affected
- up to 4.6.3
- What to do
- Affects up to 4.6.3. Update Aardvark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Coven Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69295 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Coven Core coven-core allows Blind SQL Injection.This issue affects Coven Core: from n/a through <= 1.3.
- Product
- Coven Core
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Coven Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026PeakShops: Deserialization of Untrusted DataCVE-2025-69294 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in fuelthemes PeakShops peakshops allows Object Injection.This issue affects PeakShops: from n/a through <= 1.5.9.
- Product
- PeakShops
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update PeakShops to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026New User Approve: Missing AuthorizationCVE-2025-69063 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.0.
- Product
- New User Approve
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Cool Tag Cloud: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69011 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Cool Tag Cloud cool-tag-cloud allows Stored XSS.This issue affects Cool Tag Cloud: from n/a through <= 2.29.
- Product
- Cool Tag Cloud
- Affected
- up to 2.29
- What to do
- Affects up to 2.29. Update Cool Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026AhaChat Messenger Marketing: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-68895 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in ahachat AhaChat Messenger Marketing ahachat-messenger-marketing allows Password Recovery Exploitation.This issue affects AhaChat Messenger Marketing: from n/a through <= 1.1.
- Product
- AhaChat Messenger Marketing
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update AhaChat Messenger Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Simple Archive Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68880 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Reflected XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
- Product
- Simple Archive Generator
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026iContact for Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68863 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz iContact for Gravity Forms gravity-forms-icontact allows Reflected XSS.This issue affects iContact for Gravity Forms: from n/a through <= 1.3.2.
- Product
- iContact for Gravity Forms
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update iContact for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.