Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,267 results · page 32 of 126
Feb 20, 2026Addonify – Compare Products For WooCommerce: Missing AuthorizationCVE-2025-68023 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Addonify Addonify – Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – Compare Products For WooCommerce: from n/a through <= 1.1.17.
- Product
- Addonify – Compare Products For WooCommerce
- Affected
- up to 1.1.17
- What to do
- Affects up to 1.1.17. Update Addonify – Compare Products For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Plugin BlueX for WooCommerce: Missing AuthorizationCVE-2025-68022 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in soporteblue Plugin BlueX for WooCommerce bluex-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Plugin BlueX for WooCommerce: from n/a through <= 3.1.6.
- Product
- Plugin BlueX for WooCommerce
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Plugin BlueX for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026ConveyThis: Missing AuthorizationCVE-2025-68021 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ConveyThis: from n/a through <= 269.9.
- Product
- ConveyThis
- Affected
- up to 269.9
- What to do
- Affects up to 269.9. Update ConveyThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Easy Hotel Booking: Missing AuthorizationCVE-2025-68005 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in themewant Easy Hotel Booking easy-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Hotel Booking: from n/a through <= 1.9.2.
- Product
- Easy Hotel Booking
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Easy Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Testimonial Slider: Missing AuthorizationCVE-2025-68000 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.
- Product
- Testimonial Slider
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026YayCurrency: Missing AuthorizationCVE-2025-67994 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in YayCommerce YayCurrency yaycurrency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayCurrency: from n/a through <= 3.3.
- Product
- YayCurrency
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update YayCurrency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Atarim: Missing AuthorizationCVE-2025-67993 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.2.1.
- Product
- Atarim
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026HAPPY: Missing AuthorizationCVE-2025-67977 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.8.
- Product
- HAPPY
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026aDirectory: Missing AuthorizationCVE-2025-67975 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in aDirectory aDirectory adirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects aDirectory: from n/a through <= 3.0.3.
- Product
- aDirectory
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update aDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026WPLegalPages: Missing AuthorizationCVE-2025-67974 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP Legal Pages WPLegalPages wplegalpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLegalPages: from n/a through <= 3.5.4.
- Product
- WPLegalPages
- Affected
- up to 3.5.4
- What to do
- Affects up to 3.5.4. Update WPLegalPages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2025-67973 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.5.6.2
- What to do
- Affects up to 3.5.6.2. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Zoho ZeptoMail: Missing AuthorizationCVE-2025-67972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zoho ZeptoMail: from n/a through 3.2.9.
- Product
- Zoho ZeptoMail
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Zoho ZeptoMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Schedula: Missing AuthorizationCVE-2025-67970 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Missing Authorization vulnerability in vertim Schedula schedula-smart-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schedula: from n/a through <= 1.0.
- Product
- Schedula
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Schedula to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026UPI QR Code Payment Gateway for WooCommerce: Missing AuthorizationCVE-2025-67969 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through <= 1.5.1.
- Product
- UPI QR Code Payment Gateway for WooCommerce
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update UPI QR Code Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Optimize More! – Images: Missing AuthorizationCVE-2025-67624 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Arya Dhiratara Optimize More! – Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! – Images: from n/a through <= 1.1.3.
- Product
- Optimize More! – Images
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Optimize More! – Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Konte: Missing AuthorizationCVE-2025-67547 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in uixthemes Konte konte allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Konte: from n/a through <= 2.4.6.
- Product
- Konte
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Konte to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026AIO WP Builder: Missing AuthorizationCVE-2025-53217 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through <= 2.0.2.
- Product
- AIO WP Builder
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update AIO WP Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Seraphinite Accelerator: Missing AuthorizationCVE-2024-54222 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator allows Retrieve Embedded Sensitive Data.This issue affects Seraphinite Accelerator: from n/a through <= 2.22.15.
- Product
- Seraphinite Accelerator
- Affected
- up to 2.22.15
- What to do
- Affects up to 2.22.15. Update Seraphinite Accelerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026SecuPress Free: Missing AuthorizationCVE-2024-43228 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SecuPress SecuPress Free secupress.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.
- Product
- SecuPress Free
- Affected
- up to 2.2.5.3
- What to do
- Affects up to 2.2.5.3. Update SecuPress Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Shared Files: Missing AuthorizationCVE-2024-34438 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19.
- Product
- Shared Files
- Affected
- up to 1.7.19
- What to do
- Affects up to 1.7.19. Update Shared Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026DirectoryPress: Missing AuthorizationCVE-2026-27387 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through <= 3.6.26.
- Product
- DirectoryPress
- Affected
- up to 3.6.26
- What to do
- Affects up to 3.6.26. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Missing AuthorizationCVE-2026-27368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.
- Product
- Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- Affected
- up to 6.19.8
- What to do
- Affects up to 6.19.8. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026EduBlink: Missing AuthorizationCVE-2026-27328 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DevsBlink EduBlink edublink allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduBlink: from n/a through <= 2.0.7.
- Product
- EduBlink
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update EduBlink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026YayMail: Missing AuthorizationCVE-2026-27327 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail: from n/a through <= 4.3.2.
- Product
- YayMail
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update YayMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WPAdverts: Missing AuthorizationCVE-2026-27092 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Greg Winiarski WPAdverts wpadverts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPAdverts: from n/a through <= 2.3.0.
- Product
- WPAdverts
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WPAdverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026iThemes Sync: Missing AuthorizationCVE-2026-27056 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StellarWP iThemes Sync ithemes-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through <= 3.2.8.
- Product
- iThemes Sync
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update iThemes Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Penci AI SmartContent Creator: Missing AuthorizationCVE-2026-27055 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PenciDesign Penci AI SmartContent Creator penci-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Penci AI SmartContent Creator: from n/a through <= 2.0.
- Product
- Penci AI SmartContent Creator
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Penci AI SmartContent Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026NotificationX: Missing AuthorizationCVE-2026-27042 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through <= 3.2.1.
- Product
- NotificationX
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update NotificationX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WZone: Missing AuthorizationCVE-2026-25473 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AA-Team WZone woozone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WZone: from n/a through <= 14.0.31.
- Product
- WZone
- Affected
- up to 14.0.31
- What to do
- Affects up to 14.0.31. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Sober: Missing AuthorizationCVE-2026-25459 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in uixthemes Sober sober allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sober: from n/a through <= 3.5.12.
- Product
- Sober
- Affected
- up to 3.5.12
- What to do
- Affects up to 3.5.12. Update Sober to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026LeadConnector: Missing AuthorizationCVE-2026-25441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in varunvairavanlc LeadConnector leadconnector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LeadConnector: from n/a through <= 3.0.21.
- Product
- LeadConnector
- Affected
- up to 3.0.21
- What to do
- Affects up to 3.0.21. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Real 3D FlipBook: Missing AuthorizationCVE-2026-25423 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real 3D FlipBook: from n/a through <= 4.19.1.
- Product
- Real 3D FlipBook
- Affected
- up to 4.19.1
- What to do
- Affects up to 4.19.1. Update Real 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026MailerLite: Missing AuthorizationCVE-2026-25420 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailerLite: from n/a through <= 1.7.18.
- Product
- MailerLite
- Affected
- up to 1.7.18
- What to do
- Affects up to 1.7.18. Update MailerLite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026UpsellWP: Missing AuthorizationCVE-2026-25419 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpsellWP: from n/a through <= 2.2.5.
- Product
- UpsellWP
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update UpsellWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026News Kit Elementor Addons: Missing AuthorizationCVE-2026-25416 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
- Product
- News Kit Elementor Addons
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WPBookit Pro: Missing AuthorizationCVE-2026-25415 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPBookit Pro: from n/a through <= 1.6.18.
- Product
- WPBookit Pro
- Affected
- up to 1.6.18
- What to do
- Affects up to 1.6.18. Update WPBookit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP-CORS: Missing AuthorizationCVE-2026-25410 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tstephenson WP-CORS wp-cors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CORS: from n/a through <= 0.2.2.
- Product
- WP-CORS
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update WP-CORS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026JAMstack Deployments: Missing AuthorizationCVE-2026-25409 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in crgeary JAMstack Deployments wp-jamstack-deployments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JAMstack Deployments: from n/a through <= 1.1.1.
- Product
- JAMstack Deployments
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update JAMstack Deployments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Broken Link Notifier: Missing AuthorizationCVE-2026-25408 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PluginRx Broken Link Notifier broken-link-notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Notifier: from n/a through <= 1.3.5.
- Product
- Broken Link Notifier
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Broken Link Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Cookiebot: Missing AuthorizationCVE-2026-25407 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in cookiebot Cookiebot cookiebot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookiebot: from n/a through <= 4.6.4.
- Product
- Cookiebot
- Affected
- up to 4.6.4
- What to do
- Affects up to 4.6.4. Update Cookiebot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP Job Manager: Missing AuthorizationCVE-2026-25404 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager: from n/a through <= 2.4.0.
- Product
- WP Job Manager
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Knowledge Base for Documentation, FAQs with AI Assistance: Missing AuthorizationCVE-2026-25402 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in echoplugins Knowledge Base for Documentation, FAQs with AI Assistance echo-knowledge-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through <= 16.011.0.
- Product
- Knowledge Base for Documentation, FAQs with AI Assistance
- Affected
- up to 16.011.0
- What to do
- Affects up to 16.011.0. Update Knowledge Base for Documentation, FAQs with AI Assistance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Serious Slider: Missing AuthorizationCVE-2026-25399 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CryoutCreations Serious Slider cryout-serious-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serious Slider: from n/a through <= 1.2.7.
- Product
- Serious Slider
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Serious Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Business Roy: Missing AuthorizationCVE-2026-25395 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ikreatethemes Business Roy business-roy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Roy: from n/a through <= 1.1.4.
- Product
- Business Roy
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Business Roy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Fitness FSE: Missing AuthorizationCVE-2026-25394 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fitness FSE: from n/a through <= 1.0.6.
- Product
- Fitness FSE
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Fitness FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Hello FSE: Missing AuthorizationCVE-2026-25393 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE: from n/a through <= 1.0.6.
- Product
- Hello FSE
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Hello FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WP Wand: Missing AuthorizationCVE-2026-25391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through <= 1.3.07.
- Product
- WP Wand
- Affected
- up to 1.3.07
- What to do
- Affects up to 1.3.07. Update WP Wand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026EventPrime: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25389 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.8.3.
- Product
- EventPrime
- Affected
- up to 4.2.8.3
- What to do
- Affects up to 4.2.8.3. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Ads Pro: Missing AuthorizationCVE-2026-25388 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ads Pro: from n/a through <= 5.0.
- Product
- Ads Pro
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update Ads Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Image Optimizer by Elementor: Missing AuthorizationCVE-2026-25387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Optimizer by Elementor: from n/a through <= 1.7.1.
- Product
- Image Optimizer by Elementor
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Image Optimizer by Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.