Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9,083 results · page 51 of 182
Feb 20, 2026PDF for Elementor Forms + Drag And Drop Template Builder: Missing AuthorizationCVE-2026-22350 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.3.1.
- Product
- PDF for Elementor Forms + Drag And Drop Template Builder
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update PDF for Elementor Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Lorem Ipsum | Books & Media Store: Deserialization of Untrusted DataCVE-2025-69405 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum | Books & Media Store: from n/a through <= 1.2.11.
- Product
- Lorem Ipsum | Books & Media Store
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update Lorem Ipsum | Books & Media Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Extreme Store: Deserialization of Untrusted DataCVE-2025-69404 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a through <= 1.5.10.
- Product
- Extreme Store
- Affected
- up to 1.5.10
- What to do
- Affects up to 1.5.10. Update Extreme Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Visitor Maps Extended Referer Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69389 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hugh Mungus Visitor Maps Extended Referer Field visitor-maps-extended-referer-field allows Reflected XSS.This issue affects Visitor Maps Extended Referer Field: from n/a through <= 1.2.6.
- Product
- Visitor Maps Extended Referer Field
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Visitor Maps Extended Referer Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Timeline Event History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69384 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Timeline Event History timeline-event-history allows Reflected XSS.This issue affects Timeline Event History: from n/a through <= 3.2.
- Product
- Timeline Event History
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update Timeline Event History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Themesflat Elementor: Deserialization of Untrusted DataCVE-2025-69382 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themesflat Themesflat Elementor themesflat-elementor allows Object Injection.This issue affects Themesflat Elementor: from n/a through <= 1.0.1.
- Product
- Themesflat Elementor
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Themesflat Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026WooCommerce Bulk Product Editor: Missing AuthorizationCVE-2025-69381 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0.
- Product
- WooCommerce Bulk Product Editor
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WooCommerce Bulk Product Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Upload Files Anywhere: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69380 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.
- Product
- Upload Files Anywhere
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Upload Files Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Upload Files Anywhere: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69379 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.
- Product
- Upload Files Anywhere
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Upload Files Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026User Extra Fields: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69377 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.
- Product
- User Extra Fields
- Affected
- up to 17.0
- What to do
- Affects up to 17.0. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026User Extra Fields: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69376 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.
- Product
- User Extra Fields
- Affected
- up to 17.0
- What to do
- Affects up to 17.0. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Eleblog – Elementor Blog And Magazine Addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69374 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SolverWp Eleblog – Elementor Blog And Magazine Addons ele-blog allows PHP Local File Inclusion.This issue affects Eleblog – Elementor Blog And Magazine Addons: from n/a through <= 2.0.3.
- Product
- Eleblog – Elementor Blog And Magazine Addons
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Eleblog – Elementor Blog And Magazine Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Simple Archive Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68880 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Reflected XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
- Product
- Simple Archive Generator
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Woo File Dropzone: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68862 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Murtaza Bhurgri Woo File Dropzone woo-file-dropzone allows Path Traversal.This issue affects Woo File Dropzone: from n/a through <= 1.1.7.
- Product
- Woo File Dropzone
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Woo File Dropzone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026TopperPack – Complete Elementor Addons, Theme & CPT Builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68841 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themepul TopperPack – Complete Elementor Addons, Theme & CPT Builder topper-pack allows PHP Local File Inclusion.This issue affects TopperPack – Complete Elementor Addons, Theme & CPT Builder: from n/a through <= 1.2.1.
- Product
- TopperPack – Complete Elementor Addons, Theme & CPT Builder
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update TopperPack – Complete Elementor Addons, Theme & CPT Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026ModelTheme Addons for WPBakery and Elementor: Deserialization of Untrusted DataCVE-2025-68531 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Object Injection.This issue affects ModelTheme Addons for WPBakery and Elementor: from n/a through < 1.5.6.
- Product
- ModelTheme Addons for WPBakery and Elementor
- What to do
- Update ModelTheme Addons for WPBakery and Elementor to the newest version.
Feb 20, 2026Directorist: Missing AuthorizationCVE-2025-68069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.6.6.
- Product
- Directorist
- Affected
- up to 8.6.6
- What to do
- Affects up to 8.6.6. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Open User Map: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68002 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 100plugins Open User Map open-user-map allows Path Traversal.This issue affects Open User Map: from n/a through <= 1.4.16.
- Product
- Open User Map
- Affected
- up to 1.4.16
- What to do
- Affects up to 1.4.16. Update Open User Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Miraculous Elementor: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-67998 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in kamleshyadav Miraculous Elementor miraculous-el allows Authentication Abuse.This issue affects Miraculous Elementor: from n/a through <= 2.0.7.
- Product
- Miraculous Elementor
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Miraculous Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026WPForms Google Sheet Connector: Improper Control of Generation of Code ('Code Injection')CVE-2025-67979 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Code Injection.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.1.
- Product
- WPForms Google Sheet Connector
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update WPForms Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026aDirectory: Missing AuthorizationCVE-2025-67975 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in aDirectory aDirectory adirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects aDirectory: from n/a through <= 3.0.3.
- Product
- aDirectory
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update aDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Storyform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53233 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RylanH Storyform storyform allows Reflected XSS.This issue affects Storyform: from n/a through <= 0.6.14.
- Product
- Storyform
- Affected
- up to 0.6.14
- What to do
- Affects up to 0.6.14. Update Storyform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Seraphinite Accelerator: Missing AuthorizationCVE-2024-54222 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator allows Retrieve Embedded Sensitive Data.This issue affects Seraphinite Accelerator: from n/a through <= 2.22.15.
- Product
- Seraphinite Accelerator
- Affected
- up to 2.22.15
- What to do
- Affects up to 2.22.15. Update Seraphinite Accelerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52387 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.
- Product
- Master Addons for Elementor
- Affected
- up to 2.0.9.9.4
- What to do
- Affects up to 2.0.9.9.4. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Elementor Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50555 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.29.0.
- Product
- Elementor Website Builder
- Affected
- up to 3.29.0
- What to do
- Affects up to 3.29.0. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Master Addons For Elementor: Stored Cross-Site ScriptingCVE-2026-2486 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_table_btn_text' parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Master Addons For Elementor
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Master Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 19, 2026Quiz Maker: Stored Cross-Site ScriptingCVE-2026-2384 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `vc_quizmaker` shortcode in all versions up to, and including, 6.7.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This vulnerability requires WPBakery Page Builder to be installed and active
- Product
- Quiz Maker
- Affected
- up to 6.7.1.7
- What to do
- Affects up to 6.7.1.7. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026DirectoryPress: Missing AuthorizationCVE-2026-27387 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through <= 3.6.26.
- Product
- DirectoryPress
- Affected
- up to 3.6.26
- What to do
- Affects up to 3.6.26. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Dealia – Request a Quote: Stored Cross-Site ScriptingCVE-2026-2718 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dealia – Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and including, 1.0.8. This is due to the use of `wp_kses()` for output escaping within HTML attribute contexts where `esc_attr()` is required. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Dealia – Request a Quote
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Dealia – Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026Client Testimonial Slider: Stored Cross-Site ScriptingCVE-2026-2716 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Testimonial Heading' setting in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Client Testimonial Slider
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Client Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026Penci AI SmartContent Creator: Missing AuthorizationCVE-2026-27055 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PenciDesign Penci AI SmartContent Creator penci-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Penci AI SmartContent Creator: from n/a through <= 2.0.
- Product
- Penci AI SmartContent Creator
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Penci AI SmartContent Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026LeadConnector: Missing AuthorizationCVE-2026-25441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in varunvairavanlc LeadConnector leadconnector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LeadConnector: from n/a through <= 3.0.21.
- Product
- LeadConnector
- Affected
- up to 3.0.21
- What to do
- Affects up to 3.0.21. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026News Kit Elementor Addons: Missing AuthorizationCVE-2026-25416 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
- Product
- News Kit Elementor Addons
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Image Optimizer by Elementor: Missing AuthorizationCVE-2026-25387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Optimizer by Elementor: from n/a through <= 1.7.1.
- Product
- Image Optimizer by Elementor
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Image Optimizer by Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026AI ChatBot with ChatGPT and Content Generator by AYS: Missing AuthorizationCVE-2026-25338 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.7.4.
- Product
- AI ChatBot with ChatGPT and Content Generator by AYS
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update AI ChatBot with ChatGPT and Content Generator by AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Elementor Contact Form DB: Missing AuthorizationCVE-2026-25320 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cool Plugins Elementor Contact Form DB sb-elementor-contact-form-db allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Contact Form DB: from n/a through <= 2.1.3.
- Product
- Elementor Contact Form DB
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Elementor Contact Form DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Zita Elementor Site Library: Cross-Site Request Forgery (CSRF)CVE-2026-25319 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpzita Zita Elementor Site Library zita-site-library allows Cross Site Request Forgery.This issue affects Zita Elementor Site Library: from n/a through <= 1.6.6.
- Product
- Zita Elementor Site Library
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Zita Elementor Site Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026XStore Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25307 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.7.
- Product
- XStore Core
- What to do
- Update XStore Core to the newest version.
Feb 19, 2026XStore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25305 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through <= 9.6.4.
- Product
- XStore
- Affected
- up to 9.6.4
- What to do
- Affects up to 9.6.4. Update XStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026XStore: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-25006 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through <= 9.6.4.
- Product
- XStore
- Affected
- up to 9.6.4
- What to do
- Affects up to 9.6.4. Update XStore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026CM Business Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25004 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Business Directory cm-business-directory allows Stored XSS.This issue affects CM Business Directory: from n/a through <= 1.5.3.
- Product
- CM Business Directory
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update CM Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026DirectoryPress: Missing AuthorizationCVE-2026-23548 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through <= 3.6.25.
- Product
- DirectoryPress
- Affected
- up to 3.6.25
- What to do
- Affects up to 3.6.25. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Essential Addons for Elementor: Missing AuthorizationCVE-2026-23543 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.5.
- Product
- Essential Addons for Elementor
- Affected
- up to 6.5.5
- What to do
- Affects up to 6.5.5. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026xmlrpc attacks blocker: Stored Cross-Site ScriptingCVE-2026-2502 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The xmlrpc attacks blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0, via the 'X-Forwarded-For' HTTP header. This is due to the plugin trusting and logging attacker-controlled IP header data and rendering debug log entries without output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page.
- Product
- xmlrpc attacks blocker
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update xmlrpc attacks blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026News Element Elementor Blog Magazine: Missing AuthorizationCVE-2026-2284 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The News Element Elementor Blog Magazine plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.8. This is due to a missing capability check and nonce verification on the 'ne_clean_data' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to truncate 8 core WordPress database tables (posts, comments, terms, term_relationships, term_taxonomy, postmeta, commentmeta, termmeta) and delete the entire WordPress uploads directory, resulting in complete data loss.
- Product
- News Element Elementor Blog Magazine
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update News Element Elementor Blog Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026Slidorion: Stored Cross-Site ScriptingCVE-2026-2282 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Slidorion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Slidorion
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Slidorion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026Advance Block Extend: Stored Cross-Site ScriptingCVE-2026-1646 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attribute in the Latest Posts Gutenberg block in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Advance Block Extend
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Advance Block Extend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026Easy Author Image: Stored Cross-Site ScriptingCVE-2026-1373 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author_profile_picture_url' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Easy Author Image
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Easy Author Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 19, 2026TalkJS: Stored Cross-Site ScriptingCVE-2026-1055 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The TalkJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- TalkJS
- Affected
- up to 0.1.15
- What to do
- Affects up to 0.1.15. Update TalkJS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026salavat counter: Stored Cross-Site ScriptingCVE-2026-1047 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The salavat counter Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' parameter in all versions up to, and including, 0.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- salavat counter
- Affected
- up to 0.9.5
- What to do
- Affects up to 0.9.5. Update salavat counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddownloads.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.