Vulnerability database

40,725 results · page 194 of 815

• Feb 20, 2026Woo File Dropzone: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68862 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Murtaza Bhurgri Woo File Dropzone woo-file-dropzone allows Path Traversal.This issue affects Woo File Dropzone: from n/a through <= 1.1.7.

  Product

  Woo File Dropzone

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Woo File Dropzone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Mopinion Feedback Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68856 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keeswolters Mopinion Feedback Form mopinion-feedback-form allows DOM-Based XSS.This issue affects Mopinion Feedback Form: from n/a through <= 1.1.1.

  Product

  Mopinion Feedback Form

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Mopinion Feedback Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026JobBoard Job listing: Insertion of Sensitive Information Into Sent DataCVE-2025-68855 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Insertion of Sensitive Information Into Sent Data vulnerability in themeglow JobBoard Job listing job-board-light allows Retrieve Embedded Sensitive Data.This issue affects JobBoard Job listing: from n/a through <= 1.2.8.

  Product

  JobBoard Job listing

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update JobBoard Job listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026ID Arrays: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68854 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harman79 ID Arrays id-arrays allows DOM-Based XSS.This issue affects ID Arrays: from n/a through <= 2.1.2.

  Product

  ID Arrays

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update ID Arrays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Contact Manager: Deserialization of Untrusted DataCVE-2025-68853 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in Kleor Contact Manager contact-manager allows Object Injection.This issue affects Contact Manager: from n/a through <= 9.1.1.

  Product

  Contact Manager

  Affected

  up to 9.1.1

  What to do

  Affects up to 9.1.1. Update Contact Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Court Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68852 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webmuehle Court Reservation court-reservation allows Reflected XSS.This issue affects Court Reservation: from n/a through <= 1.10.13.

  Product

  Court Reservation

  Affected

  up to 1.10.13

  What to do

  Affects up to 1.10.13. Update Court Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026amr cron manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68848 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anmari amr cron manager amr-cron-manager allows Reflected XSS.This issue affects amr cron manager: from n/a through <= 2.3.

  Product

  amr cron manager

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update amr cron manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026iSape: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68847 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itex iSape isape allows Reflected XSS.This issue affects iSape: from n/a through <= 0.72.

  Product

  iSape

  Affected

  up to 0.72

  What to do

  Affects up to 0.72. Update iSape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Asynchronous Javascript: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68846 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paris Holley Asynchronous Javascript asynchronous-javascript allows Reflected XSS.This issue affects Asynchronous Javascript: from n/a through <= 1.3.5.

  Product

  Asynchronous Javascript

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Asynchronous Javascript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026eDS Responsive Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68845 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Reflected XSS.This issue affects eDS Responsive Menu: from n/a through <= 1.2.

  Product

  eDS Responsive Menu

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update eDS Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Membee Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68844 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DaleAB Membee Login membees-member-login-widget allows Reflected XSS.This issue affects Membee Login: from n/a through <= 2.3.6.

  Product

  Membee Login

  Affected

  up to 2.3.6

  What to do

  Affects up to 2.3.6. Update Membee Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026FeedWordPress Advanced Filters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68843 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bas Schuiling FeedWordPress Advanced Filters faf allows Reflected XSS.This issue affects FeedWordPress Advanced Filters: from n/a through <= 0.6.2.

  Product

  FeedWordPress Advanced Filters

  Affected

  up to 0.6.2

  What to do

  Affects up to 0.6.2. Update FeedWordPress Advanced Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Widget Logic Visual: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68842 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalbounty Widget Logic Visual widget-logic-visual allows Reflected XSS.This issue affects Widget Logic Visual: from n/a through <= 1.52.

  Product

  Widget Logic Visual

  Affected

  up to 1.52

  What to do

  Affects up to 1.52. Update Widget Logic Visual to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026TopperPack – Complete Elementor Addons, Theme & CPT Builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68841 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themepul TopperPack – Complete Elementor Addons, Theme & CPT Builder topper-pack allows PHP Local File Inclusion.This issue affects TopperPack – Complete Elementor Addons, Theme & CPT Builder: from n/a through <= 1.2.1.

  Product

  TopperPack – Complete Elementor Addons, Theme & CPT Builder

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update TopperPack – Complete Elementor Addons, Theme & CPT Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026ELEX WordPress HelpDesk & Customer Ticketing System: Missing AuthorizationCVE-2025-68837 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through <= 3.3.5.

  Product

  ELEX WordPress HelpDesk & Customer Ticketing System

  Affected

  up to 3.3.5

  What to do

  Affects up to 3.3.5. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Sync Master Sheet – Product Sync with Google Sheet for WooCommerce: Missing AuthorizationCVE-2025-68834 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Saiful Islam Sync Master Sheet – Product Sync with Google Sheet for WooCommerce product-sync-master-sheet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sync Master Sheet – Product Sync with Google Sheet for WooCommerce: from n/a through <= 1.1.3.

  Product

  Sync Master Sheet – Product Sync with Google Sheet for WooCommerce

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Sync Master Sheet – Product Sync with Google Sheet for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Sendy: Missing AuthorizationCVE-2025-68564 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in sendy Sendy sendy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendy: from n/a through <= 3.4.2.

  Product

  Sendy

  Affected

  up to 3.4.2

  What to do

  Affects up to 3.4.2. Update Sendy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026WooCommerce Coming Soon Product with Countdown: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68552 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows PHP Local File Inclusion.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.

  Product

  WooCommerce Coming Soon Product with Countdown

  Affected

  up to 5.0

  What to do

  Affects up to 5.0. Update WooCommerce Coming Soon Product with Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Wiguard: Unrestricted Upload of File with Dangerous TypeCVE-2025-68549 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Wiguard wiguard allows Upload a Web Shell to a Web Server.This issue affects Wiguard: from n/a through < 2.0.1.

  Product

  Wiguard

  What to do

  Update Wiguard to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Nika: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68545 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.14.

  Product

  Nika

  Affected

  up to 1.2.14

  What to do

  Affects up to 1.2.14. Update Nika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Diza: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68543 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.15.

  Product

  Diza

  Affected

  up to 1.3.15

  What to do

  Affects up to 1.3.15. Update Diza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Checkout Gateway for IRIS: Missing AuthorizationCVE-2025-68542 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Gateway for IRIS: from n/a through <= 1.3.

  Product

  Checkout Gateway for IRIS

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Checkout Gateway for IRIS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Ippsum: Deserialization of Untrusted DataCVE-2025-68541 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in BoldThemes Ippsum ippsum allows Object Injection.This issue affects Ippsum: from n/a through <= 1.2.0.

  Product

  Ippsum

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Ippsum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Fana: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68539 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.35.

  Product

  Fana

  Affected

  up to 1.1.35

  What to do

  Affects up to 1.1.35. Update Fana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Zota: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68536 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.14.

  Product

  Zota

  Affected

  up to 1.3.14

  What to do

  Affects up to 1.3.14. Update Zota to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026PDF for WPForms: Missing AuthorizationCVE-2025-68534 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 6.3.0.

  Product

  PDF for WPForms

  Affected

  up to 6.3.0

  What to do

  Affects up to 6.3.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026ModelTheme Addons for WPBakery and Elementor: Deserialization of Untrusted DataCVE-2025-68531 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Object Injection.This issue affects ModelTheme Addons for WPBakery and Elementor: from n/a through < 1.5.6.

  Product

  ModelTheme Addons for WPBakery and Elementor

  What to do

  Update ModelTheme Addons for WPBakery and Elementor to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Modal Popup Box: Deserialization of Untrusted DataCVE-2025-68526 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in A WP Life Modal Popup Box modal-popup-box allows Object Injection.This issue affects Modal Popup Box: from n/a through <= 1.6.1.

  Product

  Modal Popup Box

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update Modal Popup Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Paid Member Subscriptions: Authorization Bypass Through User-Controlled KeyCVE-2025-68514 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.16.8.

  Product

  Paid Member Subscriptions

  Affected

  up to 2.16.8

  What to do

  Affects up to 2.16.8. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Mollie Payments for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68501 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mollie Mollie Payments for WooCommerce mollie-payments-for-woocommerce allows Reflected XSS.This issue affects Mollie Payments for WooCommerce: from n/a through <= 8.1.1.

  Product

  Mollie Payments for WooCommerce

  Affected

  up to 8.1.1

  What to do

  Affects up to 8.1.1. Update Mollie Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68495 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.8.0.

  Product

  JetEngine

  Affected

  up to 3.8.0

  What to do

  Affects up to 3.8.0. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Directorist: Missing AuthorizationCVE-2025-68069 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.6.6.

  Product

  Directorist

  Affected

  up to 8.6.6

  What to do

  Affects up to 8.6.6. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Shiprocket: Authorization Bypass Through User-Controlled KeyCVE-2025-68051 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shiprocket: from n/a through <= 2.0.8.

  Product

  Shiprocket

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update Shiprocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Leadpages: Missing AuthorizationCVE-2025-68050 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Leadpages Leadpages leadpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadpages: from n/a through <= 1.1.3.

  Product

  Leadpages

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Leadpages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026NextMove Lite: Missing AuthorizationCVE-2025-68048 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through <= 2.23.0.

  Product

  NextMove Lite

  Affected

  up to 2.23.0

  What to do

  Affects up to 2.23.0. Update NextMove Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026LottieFiles: Missing AuthorizationCVE-2025-68043 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LottieFiles: from n/a through <= 3.0.0.

  Product

  LottieFiles

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update LottieFiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Travelpayouts: Missing AuthorizationCVE-2025-68042 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Travelpayouts Travelpayouts travelpayouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelpayouts: from n/a through <= 1.2.2.

  Product

  Travelpayouts

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Travelpayouts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Export Media URLs: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68037 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atlas Gondal Export Media URLs export-media-urls allows Reflected XSS.This issue affects Export Media URLs: from n/a through <= 2.2.

  Product

  Export Media URLs

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Export Media URLs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Advanced WC Analytics: Missing AuthorizationCVE-2025-68032 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Passionate Brains Advanced WC Analytics advance-wc-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced WC Analytics: from n/a through <= 3.19.0.

  Product

  Advanced WC Analytics

  Affected

  up to 3.19.0

  What to do

  Affects up to 3.19.0. Update Advanced WC Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026افزونه پیامک حرفه ای فراز اس ام اس: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68031 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faraz sms افزونه پیامک حرفه ای فراز اس ام اس farazsms allows Reflected XSS.This issue affects افزونه پیامک حرفه ای فراز اس ام اس: from n/a through <= 2.7.3.

  Product

  افزونه پیامک حرفه ای فراز اس ام اس

  Affected

  up to 2.7.3

  What to do

  Affects up to 2.7.3. Update افزونه پیامک حرفه ای فراز اس ام اس to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026GA4WP: Google Analytics for: Missing AuthorizationCVE-2025-68028 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GA4WP: Google Analytics for WordPress: from n/a through <= 2.10.0.

  Product

  GA4WP: Google Analytics for

  Affected

  up to 2.10.0

  What to do

  Affects up to 2.10.0. Update GA4WP: Google Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026LC Wizard: Missing AuthorizationCVE-2025-68026 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LC Wizard: from n/a through <= 2.1.1.

  Product

  LC Wizard

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update LC Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Addonify Floating Cart For WooCommerce: Missing AuthorizationCVE-2025-68025 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Addonify Addonify Floating Cart For WooCommerce addonify-floating-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify Floating Cart For WooCommerce: from n/a through <= 1.2.17.

  Product

  Addonify Floating Cart For WooCommerce

  Affected

  up to 1.2.17

  What to do

  Affects up to 1.2.17. Update Addonify Floating Cart For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Addonify – WooCommerce Wishlist: Missing AuthorizationCVE-2025-68024 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Addonify Addonify – WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – WooCommerce Wishlist: from n/a through <= 2.0.15.

  Product

  Addonify – WooCommerce Wishlist

  Affected

  up to 2.0.15

  What to do

  Affects up to 2.0.15. Update Addonify – WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Addonify – Compare Products For WooCommerce: Missing AuthorizationCVE-2025-68023 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Addonify Addonify – Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – Compare Products For WooCommerce: from n/a through <= 1.1.17.

  Product

  Addonify – Compare Products For WooCommerce

  Affected

  up to 1.1.17

  What to do

  Affects up to 1.1.17. Update Addonify – Compare Products For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Plugin BlueX for WooCommerce: Missing AuthorizationCVE-2025-68022 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in soporteblue Plugin BlueX for WooCommerce bluex-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Plugin BlueX for WooCommerce: from n/a through <= 3.1.6.

  Product

  Plugin BlueX for WooCommerce

  Affected

  up to 3.1.6

  What to do

  Affects up to 3.1.6. Update Plugin BlueX for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026ConveyThis: Missing AuthorizationCVE-2025-68021 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ConveyThis: from n/a through <= 269.9.

  Product

  ConveyThis

  Affected

  up to 269.9

  What to do

  Affects up to 269.9. Update ConveyThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Easy Hotel Booking: Missing AuthorizationCVE-2025-68005 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in themewant Easy Hotel Booking easy-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Hotel Booking: from n/a through <= 1.9.2.

  Product

  Easy Hotel Booking

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update Easy Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Open User Map: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68002 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 100plugins Open User Map open-user-map allows Path Traversal.This issue affects Open User Map: from n/a through <= 1.4.16.

  Product

  Open User Map

  Affected

  up to 1.4.16

  What to do

  Affects up to 1.4.16. Update Open User Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Testimonial Slider: Missing AuthorizationCVE-2025-68000 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.

  Product

  Testimonial Slider

  Affected

  up to 2.0.15

  What to do

  Affects up to 2.0.15. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.