2026 CVEs (page 627)
Page 627 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27042 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-26362 | High | 8.1 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentiall… |
CVE-2026-26361 | Medium | 6.5 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access c… |
CVE-2026-26360 | High | 8.1 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access c… |
CVE-2026-26359 | High | 8.8 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access c… |
CVE-2026-26358 | High | 8.8 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially… |
CVE-2026-25473 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in AA-Team WZone woozone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WZone… |
CVE-2026-25472 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Stored X… |
CVE-2026-25463 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate Wpresidence Core wpresidence-core allows Stored… |
CVE-2026-25459 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in uixthemes Sober sober allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sober… |
CVE-2026-25453 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdempfle Advanced iFrame advanced-iframe allows DOM-Based… |
CVE-2026-25451 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Sto… |
CVE-2026-25441 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in varunvairavanlc LeadConnector leadconnector allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-25432 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This… |
CVE-2026-25428 | Medium | 4.4 | 2026-02-19 | Server-Side Request Forgery (SSRF) vulnerability in totalsoft TS Poll poll-wp allows Server Side Request Forgery.This issue affects TS Poll: from n/a through <… |
CVE-2026-25423 | Low | 3.8 | 2026-02-19 | Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-25422 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in Themes4WP Popularis Extra popularis-extra allows Cross Site Request Forgery.This issue affects Popularis Ext… |
CVE-2026-25420 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in MailerLite MailerLite official-mailerlite-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-25419 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-25418 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issu… |
CVE-2026-25416 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-25415 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-25411 | Medium | 4.3 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects… |
CVE-2026-25410 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in tstephenson WP-CORS wp-cors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects W… |
CVE-2026-25409 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in crgeary JAMstack Deployments wp-jamstack-deployments allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-25408 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in PluginRx Broken Link Notifier broken-link-notifier allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-25407 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in cookiebot Cookiebot cookiebot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-25404 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Automattic WP Job Manager wp-job-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-25402 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in echoplugins Knowledge Base for Documentation, FAQs with AI Assistance echo-knowledge-base allows Exploiting Incorrectly… |
CVE-2026-25399 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in CryoutCreations Serious Slider cryout-serious-slider allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-25395 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in ikreatethemes Business Roy business-roy allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-25394 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in sparklewpthemes Fitness FSE fitness-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-25393 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in sparklewpthemes Hello FSE hello-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-25392 | Medium | 4.7 | 2026-02-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with ne… |
CVE-2026-25391 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-25389 | Medium | 5.3 | 2026-02-19 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Re… |
CVE-2026-25388 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-25387 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-25386 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-25385 | Medium | 5.5 | 2026-02-19 | Server-Side Request Forgery (SSRF) vulnerability in KaizenCoders URL Shortify url-shortify allows Server Side Request Forgery.This issue affects URL Shortify… |
CVE-2026-25384 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2026-25378 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows B… |
CVE-2026-25375 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Acc… |
CVE-2026-25374 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in raratheme Spa and Salon spa-and-salon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-25372 | Medium | 6.5 | 2026-02-19 | Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-25370 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-25368 | Medium | 6.5 | 2026-02-19 | Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-25367 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-25364 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-25363 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in FooPlugins FooGallery foogallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-25362 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooGallery foogallery allows Stored XSS.This i… |
CVE-2026-25348 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-25343 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS wp-sms allows DOM-Based XSS.This issue… |
CVE-2026-25338 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Exploiting Incorrectly Configu… |
CVE-2026-25337 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through… |
CVE-2026-25336 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in wpcoachify Coachify coachify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-25335 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Exploiting Incorrectly… |
CVE-2026-25333 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in peregrinethemes Shopwell shopwell allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-25332 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-25331 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows DO… |
CVE-2026-25330 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-25329 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2026-25326 | High | 7.5 | 2026-02-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer… |
CVE-2026-25325 | Medium | 5.3 | 2026-02-19 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress buddypress-med… |
CVE-2026-25324 | Medium | 5.3 | 2026-02-19 | Authorization Bypass Through User-Controlled Key vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Con… |
CVE-2026-25323 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in MiKa OSM osm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OSM: from n/a th… |
CVE-2026-25322 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in PublishPress PublishPress Revisions revisionary allows Cross Site Request Forgery.This issue affects Publish… |
CVE-2026-25321 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in PSM Plugins SupportCandy supportcandy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-25320 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Cool Plugins Elementor Contact Form DB sb-elementor-contact-form-db allows Exploiting Incorrectly Configured Access Cont… |
CVE-2026-25319 | Medium | 4.3 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in wpzita Zita Elementor Site Library zita-site-library allows Cross Site Request Forgery.This issue affects Zi… |
CVE-2026-25318 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in Wisernotify team WiserReview Product Reviews for WooCommerce wiser-review allows Exploiting Incorrectly Configured Acces… |
CVE-2026-25316 | High | 7.2 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in Brainstorm Force CartFlows cartflows allows Object Injection.This issue affects CartFlows: from n/a through… |
CVE-2026-25315 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-25314 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in WP Messiah TOP Table Of Contents top-table-of-contents allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-25313 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in Shahjahan Jewel FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-25311 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in 10up Autoshare for Twitter autoshare-for-twitter allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-25310 | Medium | 4.9 | 2026-02-19 | Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/… |
CVE-2026-25308 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in wp.insider Simple Membership simple-membership allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-25307 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.Th… |
CVE-2026-25305 | Medium | 6.5 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affe… |
CVE-2026-25008 | Medium | 4.3 | 2026-02-19 | Insertion of Sensitive Information Into Sent Data vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2026-25006 | Medium | 5.3 | 2026-02-19 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XS… |
CVE-2026-25005 | Medium | 5.3 | 2026-02-19 | Authorization Bypass Through User-Controlled Key vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configu… |
CVE-2026-25004 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Business Directory cm-business-… |
CVE-2026-25003 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in madalin.ungureanu Client Portal client-portal allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-25000 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-24999 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Alma Alma alma-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-24392 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Stored XSS.Thi… |
CVE-2026-24375 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Contro… |
CVE-2026-23805 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yoren Chang Media Search Enhanced media-search-enhanced a… |
CVE-2026-23804 | Medium | 5.4 | 2026-02-19 | Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2026-23803 | Medium | 6.4 | 2026-02-19 | Server-Side Request Forgery (SSRF) vulnerability in Burhan Nasir Smart Auto Upload Images smart-auto-upload-images allows Server Side Request Forgery.This issu… |
CVE-2026-23549 | Critical | 9.8 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2026-23548 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-23547 | High | 7.1 | 2026-02-19 | Missing Authorization vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-23545 | Medium | 6.5 | 2026-02-19 | Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-23544 | High | 8.8 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through <= 5.6.3.5. |
CVE-2026-23543 | Medium | 5.3 | 2026-02-19 | Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured… |
CVE-2026-23542 | Critical | 9.8 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: fro… |
CVE-2026-23541 | High | 7.5 | 2026-02-19 | Missing Authorization vulnerability in WPFunnels Mail Mint mail-mint allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mail Mi… |