Wordfence Intelligence Weekly WordPress Vulnerability Report (February 9, 2026 to February 15, 2026)
🔥🔥🔥 Triple Threat Bug Bounty Challenge 🔥🔥🔥
Hunt High Threat vulnerabilities and earn triple the incentives!
Now through April 6, 2026, earn three stacked bonuses on all valid submissions from our ‘High Threat Vulnerabilities’ list:
- 💰 2x all high threat vulnerability bounties (excluding 5,000,000+ installs)
- 📈 +30% bonus for high threat vulnerabilities in software with 30,000+ active installs (excluding 5,000,000+ installs)
- 🎯 $300 extra for every 3 High Threat vulnerabilities submitted (minimum of 1,000 installs)
Use the Bounty Estimator to see what rewards are possible through the promotion. Submit through our Bug Bounty Program today to maximize your impact and your payout.
Last week, there were 267 vulnerabilities disclosed in 188 WordPress Plugins and 66 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 79 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 33,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
-
-
- WAF-RULE-894 – Data redacted while we work with the vendor on a patch.
-
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 162 |
| Unpatched | 105 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 194 |
| High Severity | 65 |
| Critical Severity | 8 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 79 |
| Missing Authorization | 77 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 24 |
| Cross-Site Request Forgery (CSRF) | 21 |
| Deserialization of Untrusted Data | 13 |
| Server-Side Request Forgery (SSRF) | 10 |
| Authorization Bypass Through User-Controlled Key | 7 |
| Improper Control of Generation of Code ('Code Injection') | 6 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 6 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 6 |
| Exposure of Sensitive Information to an Unauthorized Actor | 4 |
| Improper Privilege Management | 4 |
| Unrestricted Upload of File with Dangerous Type | 3 |
| Missing Authentication for Critical Function | 2 |
| Improper Authentication | 1 |
| Improper Input Validation | 1 |
| Incorrect Authorization | 1 |
| Insufficient Verification of Data Authenticity | 1 |
| Reliance on Reverse DNS Resolution for a Security-Critical Action | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 23 | |
| 21 | |
| 19 | |
| 16 | |
| 15 | |
| 13 | |
| 11 | |
| 10 | |
| 10 | |
| 8 | |
| 8 | |
| 6 | |
| 6 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Accordion and Accordion Slider | accordion-and-accordion-slider |
| Activity Log for WordPress | winterlock |
| Address Bar Ads | address-bar-ads |
| Allow HTML in Category Descriptions | allow-html-in-category-descriptions |
| Alt Text AI – Automatically generate image alt text for SEO and accessibility | alttext-ai |
| AMP Enhancer – Compatibility Layer for Official AMP Plugin | amp-enhancer |
| Appointment Booking Calendar Plugin – Bookr | bookr |
| Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | latepoint |
| Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback | atarim-visual-collaboration |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| BFG Tools – Extension Zipper | bfg-tools-extension-zipper |
| Blog Filter – Post Grid Filter by Category or Tag | blog-filter |
| BlueSnap Payment Gateway for WooCommerce | bluesnap-payment-gateway-for-woocommerce |
| Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment | booking-and-rental-manager-for-woocommerce |
| Booking Calendar | booking |
| Bravis Addons | bravis-addons |
| BuddyHolis ListSearch | listsearch |
| Business Template Blocks for WPBakery (Visual Composer) Page Builder | templates-and-addons-for-wpbakery-page-builder |
| CallbackKiller service widget | callbackkiller-service-widget |
| Category Image | category-image |
| Chatbot for WordPress by Collect.chat ⚡️ | collectchat |
| Citations tools | citations-tools |
| Cliengo – Chatbot | cliengo |
| Cnvrse | cnvrse |
| Converter for Media – Optimize images | Convert WebP & AVIF | webp-converter-for-media |
| Custom Block Builder – Lazy Blocks | lazy-blocks |
| Custom Query Blocks | post-type-archive-mapping |
| Customer Reviews for WooCommerce | customer-reviews-woocommerce |
| Delivery Date Time & Pickup for WooCommerce | byconsole-woo-order-delivery-time |
| Download Attachments | download-attachments |
| Download Manager | download-manager |
| Download Manager Addons for Elementor | wpdm-elementor |
| Easy Form | easy-form |
| Easy Form Builder by WhiteStudio – Drag & Drop Form Builder | easy-form-builder |
| Easy Table of Contents | easy-table-of-contents |
| Easy Voice Mail | easy-voice-mail |
| Ecwid by Lightspeed Ecommerce Shopping Cart | ecwid-shopping-cart |
| Editorial Calendar | editorial-calendar |
| Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | bdthemes-element-pack-lite |
| Elementor Website Builder – more than just a page builder | elementor |
| Embed PDF Viewer | embed-pdf-viewer |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | mage-eventpress |
| FastDup – Fastest WordPress Migration & Duplicator | fastdup |
| Flexi Product Slider and Grid for WooCommerce | flexi-product-slider-grid |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| Geo Widget | geowidget |
| Getty Images | getty-images |
| GlobalPayments Gateway Provider for WooCommerce | global-payments-woocommerce |
| HTML Shortcodes | html-shortcodes |
| Hydra Booking — Appointment Scheduling & Booking Calendar | hydra-booking |
| Icon List Block – create beautiful lists with icons instead of bullets | icon-list-block |
| IDE Micro code-editor | flask-micro |
| iGMS Direct Booking | igms-direct-booking |
| Image Gallery | new-image-gallery |
| Image Photo Gallery Final Tiles Grid | final-tiles-grid-gallery-lite |
| iMoney | imoney |
| Invoct – PDF Invoices & Billing for WooCommerce | kirilkirkov-pdf-invoice-manager |
| iONE360 configurator | ione360-configurator |
| JetEngine | jet-engine |
| JS Help Desk – AI-Powered Support & Ticketing System | js-support-ticket |
| JW Player for WordPress | jw-player-7-for-wp |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| Leaflet Map | leaflet-map |
| LearnPress – Backup & Migration Tool | learnpress-import-export |
| Link Hopper | link-hopper |
| Livemesh Addons by Elementor | addons-for-elementor |
| Login with Salesforce | login-with-salesforce |
| Lucky Wheel Giveaway | wp-lucky-wheel |
| Magic Login Mail or QR Code | magic-login-mail |
| Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails | mail-mint |
| MailChimp Campaigns | olalaweb-mailchimp-campaign-manager |
| MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails | mailerpress |
| MAS Videos | masvideos |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| MDirector Newsletter WordPress Plugin | mdirector-newsletter |
| Media Library Folders | media-library-plus |
| Microtango | microtango |
| midi-Synth | midi-synth |
| Miraculous Elementor | miraculous-el |
| MMA Call Tracking | mma-call-tracking |
| Modal Popup Box — Popup Maker & Popup Builder | modal-popup-box |
| Modula Image Gallery – Photo Grid & Video Gallery | modula-best-grid-gallery |
| Mollie Payments for WooCommerce | mollie-payments-for-woocommerce |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| Name Directory | name-directory |
| New User Approve | new-user-approve |
| NEX-Forms – Ultimate Forms Plugin for WordPress | nex-forms-express-wp-form-builder |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| One to one user Chat by WPGuppy | wpguppy-lite |
| OpenPix for WooCommerce | openpix-for-woocommerce |
| OpenPOS Lite – Point of Sale for WooCommerce | wpos-lite-version |
| Orbisius Random Name Generator | orbisius-random-name-generator |
| Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | paid-member-subscriptions |
| Passster – Password Protect Pages and Content | content-protector |
| Payment Page – Stripe Payment Forms for Donations, Subscriptions & Recurring Payments | payment-page |
| Payment Plugins for PayPal WooCommerce | pymntpl-paypal-woocommerce |
| PDF for Elementor Forms + Drag And Drop Template Builder | pdf-for-elementor-forms |
| PDF for WPForms + Drag and Drop Template Builder | pdf-for-wpforms |
| Percent to Infograph | percent-to-infograph |
| personal-authors-category | personal-authors-category |
| Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel | foogallery |
| PhotoStack Gallery | photostack-gallery |
| PixelYourSite Pro – Your smart PIXEL (TAG) Manager | pixelyoursite-pro |
| PixelYourSite – Your smart PIXEL (TAG) & API Manager | pixelyoursite |
| Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | mycred |
| Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers | popup-builder-block |
| PowerPack for LearnDash | powerpack-for-learndash |
| PowerPress Podcasting plugin by Blubrry | powerpress |
| Press3D | press3d |
| Primer MyData for Woocommerce | primer-mydata |
| Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) | uni-woo-custom-product-options-premium |
| Qubely – Advanced Gutenberg Blocks | qubely |
| QuestionPro Surveys | questionpro-surveys |
| Quiz Maker by AYS | quiz-maker |
| Ravelry Designs Widget | ravelry-designs-widget |
| Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder | real3d-flipbook-lite |
| Responsive Slideshow – Photo Carousel | slider-responsive-slideshow |
| Rich Showcase for Google Reviews | widget-google-reviews |
| Robo Gallery – Photo & Image Slider | robo-gallery |
| RPS Include Content | rps-include-content |
| RVCFDI para Woocommerce | rvcfdi-para-woocommerce |
| Scheduler Widget | scheduler-widget |
| School Management System – WPSchoolPress | wpschoolpress |
| SEATT: Simple Event Attendance | simple-event-attendance |
| Secure Copy Content Protection and Content Locking | secure-copy-content-protection |
| Share This Image | share-this-image |
| Simple Blog Card | simple-blog-card |
| Simple File List | simple-file-list |
| Simple Plyr | simple-plyr |
| Simple Retail Menus | simple-retail-menus |
| Simple Wp colorfull Accordion | simple-wp-colorfull-accordion |
| Slideshow Wp | slideshow-wp |
| SlimStat Analytics | wp-slimstat |
| Smart Forms – when you need more than just a contact form | smart-forms |
| Spam protection, Honeypot, Anti-Spam by CleanTalk | cleantalk-spam-protect |
| Sphere Manager | sphere-manager |
| Sprout Invoices – Client Invoicing & Estimates | sprout-invoices |
| Starfish Review Generation & Marketing for WordPress | starfish-reviews |
| StickEasy Protected Contact Form | stickeasy-protected-contact-form |
| StyleBidet | stylebidet |
| Sudoku Shortcode | sudoku-shortcode |
| Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals | wp-cloudflare-page-cache |
| Super Simple Contact Form | super-simple-contact-form |
| SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz | sureforms |
| The Events Calendar Shortcode & Block | the-events-calendar-shortcode |
| Theme Editor | theme-editor |
| Themesflat Elementor | themesflat-elementor |
| Timeline Event History | timeline-event-history |
| TotalPoll for Polls and Contests | totalpoll-lite |
| Truelysell Core | truelysell-core |
| Twitter posts to Blog | twitter-posts-to-blog |
| UnitechPay – Wave & Orange Money Payments | unitechpay-paiements-mobile-money |
| UpMenu – Online ordering for restaurants | upmenu |
| User Language Switch | user-language-switch |
| Video Conferencing with Zoom | video-conferencing-with-zoom-api |
| Videospirecore Theme Plugin | videospirecore |
| Visitor Maps Extended Referer Field | visitor-maps-extended-referer-field |
| WaMate Confirm – Order Confirmation | wamate-confirm |
| WCFM Marketplace – Multivendor Marketplace for WooCommerce | wc-multivendor-marketplace |
| WCFM Membership – WooCommerce Memberships for Multivendor Marketplace | wc-multivendor-membership |
| WCFM – Frontend Manager for WooCommerce | wc-frontend-manager |
| WDES Responsive Popup | wdes-responsive-popup |
| Whizz Plugins | whizz-plugins |
| WooCommerce Bulk Product Editor | woocommerce-quick-product-editor |
| WooCommerce Coming Soon Product with Countdown | woo-coming-soon-product |
| WordPress Upload Files Anywhere | wp-upload-files-anywhere |
| WordPress User Extra Fields | wp-user-extra-fields |
| WP Activity Log | wp-security-audit-log |
| WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | wp-data-access |
| WP eCommerce | wp-e-commerce |
| WP FullCalendar | wp-fullcalendar |
| WP Last Modified Info | wp-last-modified-info |
| WP Quick Contact Us | wp-quick-contact-us |
| WP Sessions Time Monitoring Full Automatic | activitytime |
| WP Simple HTML Sitemap | wp-simple-html-sitemap |
| WP Ultimate Review | wp-ultimate-review |
| wpForo Forum | wpforo |
| WPLifeCycle – Free PHP Version Info & Website Manager | free-php-version-info |
| WPlyr Media Block | wplyr-media-block |
| WPshop 2 – E-Commerce | wpshop |
| WPvivid — Backup, Migration & Staging | wpvivid-backuprestore |
| WPZOOM Addons for Elementor – Starter Templates & Widgets | wpzoom-elementor-addons |
| WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce | wp-sms |
| YayCurrency – WooCommerce Multi-Currency Switcher | yaycurrency |
| Yoast Duplicate Post | duplicate-post |
| ZoomifyWP Free | tz-zoomifywp-free |
| افزونه پیامک ووکامرس Persian WooCommerce SMS | persian-woocommerce-sms |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| AdForest | adforest |
| Appointment | appointment |
| apuslisting | apuslisting |
| Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) | armania |
| Ashe | ashe |
| Bakes And Cakes | bakes-and-cakes |
| Belletrist - Blog Theme for WordPress Theme | belletrist |
| Benevolent | benevolent |
| Biolife - Organic Food WordPress Theme ( RTL Supported ) | biolife |
| Blackfyre - Create Your Own Gaming Community | blackfyre |
| Bluestreet | bluestreet |
| Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) | kute-boutique |
| Business One Page | business-one-page |
| Busiprof | busiprof |
| Cartify - WooCommerce Gutenberg WordPress | cartify |
| Chocolate House | chocolate-house |
| Cobble | cobble |
| Construction Landing Page | construction-landing-page |
| Corpiva | corpiva |
| Cream Blog | cream-blog |
| Dating | DA10 |
| Diamond | diamond |
| Diza - Pharmacy Store Elementor WooCommerce Theme | diza |
| Duka Market - Multipurpose eCommerce Template | dukamarket |
| Education Base | education-base |
| Electronics eCommerce WordPress Woocommerce Theme - Exzo | exzo |
| Extreme Store | extremestore |
| Fana - Fashion Shop WordPress Theme | fana |
| FiveStar - Hotel Booking WordPress Theme | fivestar |
| FreightCo – Free Transportation & Logistics WordPress Theme | freightco |
| Gable - Structure & Building Franework WordPress Theme | gable |
| Grand Blog WordPress | grandblog |
| Grand Car Rental | Limousine HTML Template | grandcarrental |
| Grand Magazine | Blog WordPress | grandmagazine |
| Grand Portfolio WordPress | grandportfolio |
| HealthFirst - Nutrition and Recipes WordPress Theme | healthfirst |
| JobScout | jobscout |
| kuteshop | kuteshop |
| Lawyer Landing Page | lawyer-landing-page |
| Lorem Ipsum | lorem-ipsum-books-media-store |
| Mogi - A Creative Portfolio / Agency WordPress Theme | mogi |
| Nestin | nestin |
| NewsExo | newsexo |
| Nika - Medical Elementor WooCommerce Theme | nika |
| PatioTime - Restaurant WordPress Theme | patiotime |
| Perfect Portfolio | perfect-portfolio |
| PJ | Life & Business Coaching Site Template | pj |
| Plank - Carpenter, Flooring & Woodworker WordPress Theme | plank |
| Preschool and Kindergarten | preschool-and-kindergarten |
| Prestige | prestige |
| R&F - Roof & Floor Carpenter WordPress Theme | rf |
| Rara Business | rara-business |
| Restaurant and Cafe | restaurant-and-cafe |
| Royale News | royale-news |
| SpicePress | spicepress |
| Splendour | splendour |
| Struktur - Creative Agency WordPress Theme | struktur |
| TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) | techone |
| The Conference | the-conference |
| Tint - Renovation, Painting & Wallpapering WordPress Theme | tint |
| Travel Agency | travel-agency |
| Travel Booking | travel-booking |
| Travelicious - Tour Operator WordPress Theme | travelicious |
| Uminex - Multipurpose WooCommerce Theme | uminex |
| Yokoo | yokoo |
| Zota - Elementor Multi-Purpose WooCommerce Theme | zota |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Login with Salesforce [login-with-salesforce]
Researcher
Affected Software
midi-Synth [midi-synth]
Affected Software
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]
Researcher
Affected Software
PowerPack for LearnDash [powerpack-for-learndash]
Researcher
Affected Software
Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect]
Researcher
Affected Software
Truelysell Core [truelysell-core]
Researcher
Affected Software
WordPress Upload Files Anywhere [wp-upload-files-anywhere]
Researcher
Affected Software
Bravis Addons [bravis-addons]
Researcher
Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution
8.8
Affected Software
Custom Block Builder – Lazy Blocks [lazy-blocks]
Researcher
Affected Software
Ecwid by Lightspeed Ecommerce Shopping Cart [ecwid-shopping-cart]
Researcher
Affected Software
Affected Software
Miraculous Elementor [miraculous-el]
Researcher
Affected Software
Starfish Review Generation & Marketing for WordPress [starfish-reviews]
Affected Software
Videospirecore Theme Plugin [videospirecore]
Researcher
Affected Software
wpForo Forum [wpforo]
Researcher
Affected Software
Belletrist - Blog Theme for WordPress Theme [belletrist]
Researcher
Affected Software
Cobble [cobble]
Researcher
Affected Software
Researcher
Affected Software
Extreme Store [extremestore]
Researcher
Affected Software
Researcher
Affected Software
FiveStar - Hotel Booking WordPress Theme [fivestar]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
HealthFirst - Nutrition and Recipes WordPress Theme [healthfirst]
Researcher
Affected Software
Lorem Ipsum [lorem-ipsum-books-media-store]
Researcher
Affected Software
Magic Login Mail or QR Code [magic-login-mail]
Researcher
Affected Software
Nestin [nestin]
Researcher
Affected Software
Researcher
Affected Software
PatioTime - Restaurant WordPress Theme [patiotime]
Researcher
Affected Software
PatioTime - Restaurant WordPress Theme [patiotime]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPshop 2 – E-Commerce [wpshop]
Researcher
Affected Software
Simple Retail Menus [simple-retail-menus]
Researcher
Affected Software
Splendour [splendour]
Researcher
Affected Software
Struktur - Creative Agency WordPress Theme [struktur]
Researcher
Affected Software
Themesflat Elementor [themesflat-elementor]
Researcher
Affected Software
Researcher
Affected Software
Travelicious - Tour Operator WordPress Theme [travelicious]
Researcher
Affected Software
Yokoo [yokoo]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
BlueSnap Payment Gateway for WooCommerce [bluesnap-payment-gateway-for-woocommerce]
Researcher
Affected Software
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment [booking-and-rental-manager-for-woocommerce]
Researcher
Affected Software
Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) [kute-boutique]
Researcher
Affected Software
Download Manager Addons for Elementor [wpdm-elementor]
Researcher
Affected Software
Flexi Product Slider and Grid for WooCommerce [flexi-product-slider-grid]
Researcher
Affected Software
Image Gallery [new-image-gallery]
Researcher
Affected Software
Modal Popup Box — Popup Maker & Popup Builder [modal-popup-box]
Researcher
Affected Software
Researcher
Affected Software
PhotoStack Gallery [photostack-gallery]
Researcher
Affected Software
Responsive Slideshow – Photo Carousel [slider-responsive-slideshow]
Researcher
Affected Software
Researcher
Affected Software
WordPress Upload Files Anywhere [wp-upload-files-anywhere]
Researcher
Affected Software
WooCommerce Coming Soon Product with Countdown [woo-coming-soon-product]
Researcher
Affected Software
Customer Reviews for WooCommerce [customer-reviews-woocommerce]
Researcher
Affected Software
GlobalPayments Gateway Provider for WooCommerce [global-payments-woocommerce]
Researcher
Affected Software
iONE360 configurator [ione360-configurator]
Researcher
Affected Software
Lucky Wheel Giveaway [wp-lucky-wheel]
Researcher
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Affected Software
Name Directory [name-directory]
Researcher
Affected Software
PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite]
Researcher
Affected Software
PixelYourSite Pro – Your smart PIXEL (TAG) Manager [pixelyoursite-pro]
Researcher
Affected Software
Secure Copy Content Protection and Content Locking [secure-copy-content-protection]
Researcher
Affected Software
Share This Image [share-this-image]
Researcher
Affected Software
Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals [wp-cloudflare-page-cache]
Researcher
Affected Software
Super Simple Contact Form [super-simple-contact-form]
Researcher
Affected Software
WordPress User Extra Fields [wp-user-extra-fields]
Researcher
Affected Software
WCFM – Frontend Manager for WooCommerce [wc-frontend-manager]
Researcher
Affected Software
Activity Log for WordPress [winterlock]
Affected Software
Researcher
Affected Software
Download Attachments [download-attachments]
Researcher
Affected Software
Duka Market - Multipurpose eCommerce Template [dukamarket]
Researcher
Affected Software
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
Affected Software
JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]
Researcher
Affected Software
Simple File List [simple-file-list]
Researcher
Affected Software
SlimStat Analytics [wp-slimstat]
Researcher
Affected Software
Researcher
Twitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Update
6.5
Affected Software
Twitter posts to Blog [twitter-posts-to-blog]
Researcher
Affected Software
Researcher
Affected Software
WP Activity Log [wp-security-audit-log]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Affected Software
Blog Filter – Post Grid Filter by Category or Tag [blog-filter]
Researcher
Affected Software
BuddyHolis ListSearch [listsearch]
Researcher
Affected Software
Chatbot for WordPress by Collect.chat ⚡️ [collectchat]
Researcher
Affected Software
Citations tools [citations-tools]
Researcher
Affected Software
Custom Query Blocks [post-type-archive-mapping]
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Editorial Calendar [editorial-calendar]
Researcher
Affected Software
Researcher
Affected Software
Embed PDF Viewer [embed-pdf-viewer]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Getty Images [getty-images]
Researcher
Affected Software
HTML Shortcodes [html-shortcodes]
Researcher
Affected Software
Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]
Researcher
Affected Software
Icon List Block – create beautiful lists with icons instead of bullets [icon-list-block]
Researcher
Affected Software
IDE Micro code-editor [flask-micro]
Researcher
Affected Software
Leaflet Map [leaflet-map]
Researcher
Affected Software
Livemesh Addons by Elementor [addons-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
Microtango [microtango]
Researcher
Affected Software
Researcher
Affected Software
OpenPOS Lite – Point of Sale for WooCommerce [wpos-lite-version]
Researcher
Affected Software
Orbisius Random Name Generator [orbisius-random-name-generator]
Researcher
Affected Software
Researcher
Affected Software
Percent to Infograph [percent-to-infograph]
Researcher
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Affected Software
Press3D [press3d]
Affected Software
Qubely – Advanced Gutenberg Blocks [qubely]
Researcher
Affected Software
QuestionPro Surveys [questionpro-surveys]
Researcher
Affected Software
Ravelry Designs Widget [ravelry-designs-widget]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Affected Software
Simple Blog Card [simple-blog-card]
Researcher
Affected Software
WP Simple HTML Sitemap [wp-simple-html-sitemap]
Researcher
Affected Software
Simple Plyr [simple-plyr]
Researcher
Affected Software
Simple Wp colorfull Accordion [simple-wp-colorfull-accordion]
Researcher
Affected Software
Slideshow Wp [slideshow-wp]
Researcher
Affected Software
Sphere Manager [sphere-manager]
Researcher
Affected Software
Sudoku Shortcode [sudoku-shortcode]
Researcher
Patch Status
Unpatched
Unpatched
Published
Feb 10, 2026
Feb 10, 2026
Affected Software
Sudoku Shortcode [sudoku-shortcode]
Researcher
Affected Software
The Events Calendar Shortcode & Block [the-events-calendar-shortcode]
Researcher
Affected Software
Researcher
Affected Software
WDES Responsive Popup [wdes-responsive-popup]
Researcher
Affected Software
Researcher
Affected Software
ZoomifyWP Free [tz-zoomifywp-free]
Researcher
Affected Software
Address Bar Ads [address-bar-ads]
Researcher
Affected Software
Business Template Blocks for WPBakery (Visual Composer) Page Builder [templates-and-addons-for-wpbakery-page-builder]
Researcher
Affected Software
Diamond [diamond]
Researcher
Affected Software
Easy Voice Mail [easy-voice-mail]
Researcher
Affected Software
Geo Widget [geowidget]
Researcher
Affected Software
Mollie Payments for WooCommerce [mollie-payments-for-woocommerce]
Researcher
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]
Researcher
Affected Software
افزونه پیامک ووکامرس Persian WooCommerce SMS [persian-woocommerce-sms]
Researcher
Affected Software
personal-authors-category [personal-authors-category]
Researcher
Affected Software
RVCFDI para Woocommerce [rvcfdi-para-woocommerce]
Researcher
Affected Software
StyleBidet [stylebidet]
Researcher
Affected Software
Timeline Event History [timeline-event-history]
Researcher
Affected Software
Visitor Maps Extended Referer Field [visitor-maps-extended-referer-field]
Researcher
Affected Software
Whizz Plugins [whizz-plugins]
Researcher
Affected Software
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) [uni-woo-custom-product-options-premium]
Researcher
Affected Software
User Language Switch [user-language-switch]
Researcher
Affected Software
Accordion and Accordion Slider [accordion-and-accordion-slider]
Researcher
Affected Software
Researcher
Affected Software
Scheduler Widget [scheduler-widget]
Researcher
Affected Software
Researcher
Affected Software
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback [atarim-visual-collaboration]
Researcher
Affected Software
Bakes And Cakes [bakes-and-cakes]
Researcher
Affected Software
Benevolent [benevolent]
Researcher
Affected Software
Researcher
Affected Software
Business One Page [business-one-page]
Researcher
Affected Software
CallbackKiller service widget [callbackkiller-service-widget]
Researcher
Affected Software
Chocolate House [chocolate-house]
Researcher
Affected Software
Sprout Invoices – Client Invoicing & Estimates [sprout-invoices]
Researcher
Affected Software
Cnvrse [cnvrse]
Researcher
Affected Software
Construction Landing Page [construction-landing-page]
Researcher
Affected Software
Cream Blog [cream-blog]
Researcher
Affected Software
Dating [DA10]
Researcher
Affected Software
Researcher
Affected Software
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]
Researcher
Affected Software
Education Base [education-base]
Researcher
Affected Software
Researcher
Affected Software
WP FullCalendar [wp-fullcalendar]
Researcher
Affected Software
iGMS Direct Booking [igms-direct-booking]
Researcher
Affected Software
JobScout [jobscout]
Researcher
Affected Software
kuteshop [kuteshop]
Researcher
Affected Software
Researcher
Affected Software
Lawyer Landing Page [lawyer-landing-page]
Researcher
Affected Software
MailChimp Campaigns [olalaweb-mailchimp-campaign-manager]
Researcher
Affected Software
MAS Videos [masvideos]
Researcher
Affected Software
Researcher
Affected Software
New User Approve [new-user-approve]
Researcher
Affected Software
One to one user Chat by WPGuppy [wpguppy-lite]
Researcher
Affected Software
Payment Plugins for PayPal WooCommerce [pymntpl-paypal-woocommerce]
Researcher
Affected Software
Perfect Portfolio [perfect-portfolio]
Researcher
Affected Software
Preschool and Kindergarten [preschool-and-kindergarten]
Researcher
Affected Software
Primer MyData for Woocommerce [primer-mydata]
Researcher
Affected Software
Rara Business [rara-business]
Researcher
Affected Software
Restaurant and Cafe [restaurant-and-cafe]
Researcher
Affected Software
Royale News [royale-news]
Researcher
Affected Software
WP Sessions Time Monitoring Full Automatic [activitytime]
Researcher
Affected Software
StickEasy Protected Contact Form [stickeasy-protected-contact-form]
Researcher
Patch Status
Patched
Patched
Published
Feb 15, 2026
Feb 15, 2026
Affected Software
Researcher
Affected Software
The Conference [the-conference]
Researcher
Affected Software
Travel Agency [travel-agency]
Researcher
Affected Software
Travel Booking [travel-booking]
Researcher
Affected Software
WP Ultimate Review [wp-ultimate-review]
Researcher
Affected Software
UnitechPay – Wave & Orange Money Payments [unitechpay-paiements-mobile-money]
Researcher
Affected Software
WaMate Confirm – Order Confirmation [wamate-confirm]
Researcher
Affected Software
WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace]
Researcher
Affected Software
Delivery Date Time & Pickup for WooCommerce [byconsole-woo-order-delivery-time]
Researcher
Affected Software
WP Last Modified Info [wp-last-modified-info]
Researcher
Affected Software
WPLifeCycle – Free PHP Version Info & Website Manager [free-php-version-info]
Researcher
Affected Software
WPZOOM Addons for Elementor – Starter Templates & Widgets [wpzoom-elementor-addons]
Researcher
Affected Software
YayCurrency – WooCommerce Multi-Currency Switcher [yaycurrency]
Researcher
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Affected Software
BFG Tools – Extension Zipper [bfg-tools-extension-zipper]
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
Researcher
Affected Software
Converter for Media – Optimize images | Convert WebP & AVIF [webp-converter-for-media]
Researcher
Affected Software
LearnPress – Backup & Migration Tool [learnpress-import-export]
Researcher
Affected Software
Allow HTML in Category Descriptions [allow-html-in-category-descriptions]
Researcher
Affected Software
AMP Enhancer – Compatibility Layer for Official AMP Plugin [amp-enhancer]
Researcher
Affected Software
Category Image [category-image]
Researcher
Affected Software
Yoast Duplicate Post [duplicate-post]
Researcher
Affected Software
Link Hopper [link-hopper]
Researcher
Rich Showcase for Google Reviews <= 6.9.4.3 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
Affected Software
Rich Showcase for Google Reviews [widget-google-reviews]
Researcher
Affected Software
User Language Switch [user-language-switch]
Researcher
Affected Software
WPlyr Media Block [wplyr-media-block]
Researcher
Affected Software
Researcher
Affected Software
Appointment [appointment]
Researcher
Affected Software
apuslisting [apuslisting]
Researcher
Affected Software
Ashe [ashe]
Researcher
Affected Software
Blackfyre - Create Your Own Gaming Community [blackfyre]
Researcher
Affected Software
Bluestreet [bluestreet]
Researcher
Affected Software
Busiprof [busiprof]
Researcher
Affected Software
Researcher
Affected Software
Cliengo – Chatbot [cliengo]
Researcher
Affected Software
Corpiva [corpiva]
Researcher
Affected Software
Easy Table of Contents [easy-table-of-contents]
Researcher
Affected Software
WP eCommerce [wp-e-commerce]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Grand Blog WordPress [grandblog]
Researcher
Affected Software
Grand Car Rental | Limousine HTML Template [grandcarrental]
Researcher
Affected Software
Grand Magazine | Blog WordPress [grandmagazine]
Researcher
Affected Software
Grand Portfolio WordPress [grandportfolio]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Image Photo Gallery Final Tiles Grid [final-tiles-grid-gallery-lite]
Researcher
Affected Software
Invoct – PDF Invoices & Billing for WooCommerce [kirilkirkov-pdf-invoice-manager]
Researchers
Affected Software
JW Player for WordPress [jw-player-7-for-wp]
Researcher
Affected Software
Researcher
Affected Software
MDirector Newsletter WordPress Plugin [mdirector-newsletter]
Researcher
Affected Software
Media Library Folders [media-library-plus]
Researcher
Affected Software
MMA Call Tracking [mma-call-tracking]
Researcher
Affected Software
Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]
Researcher
Affected Software
NewsExo [newsexo]
Researcher
Affected Software
OpenPix for WooCommerce [openpix-for-woocommerce]
Researcher
Paid Member Subscriptions <= 2.16.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]
Researcher
Affected Software
Passster – Password Protect Pages and Content [content-protector]
Researcher
Affected Software
PDF for Elementor Forms + Drag And Drop Template Builder [pdf-for-elementor-forms]
Researcher
Affected Software
PDF for WPForms + Drag and Drop Template Builder [pdf-for-wpforms]
Researcher
Affected Software
Quiz Maker by AYS [quiz-maker]
Researcher
Affected Software
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite]
Researcher
Affected Software
RPS Include Content [rps-include-content]
Researcher
SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion
4.3
Affected Software
SEATT: Simple Event Attendance [simple-event-attendance]
Researcher
Smart Forms <= 2.6.100 - Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure
4.3
Affected Software
Researcher
Affected Software
SpicePress [spicepress]
Researcher
Affected Software
Theme Editor [theme-editor]
Researcher
Affected Software
TotalPoll for Polls and Contests [totalpoll-lite]
Researcher
Affected Software
Video Conferencing with Zoom [video-conferencing-with-zoom-api]
Researcher
Affected Software
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership]
Researcher
Affected Software
WooCommerce Bulk Product Editor [woocommerce-quick-product-editor]
Researcher
Affected Software
WP Quick Contact Us [wp-quick-contact-us]
Researcher
Affected Software
Researcher
Affected Software
School Management System – WPSchoolPress [wpschoolpress]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments