2026 CVE Vulnerabilities
83,646 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-1249 | MEDIUM | 5 | 0.2% | Feb 14, 2026 | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side ... |
| CVE-2026-0550 | MEDIUM | 6.4 | 0.2% | Feb 14, 2026 | The myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mycred_load_coupon' short... |
| CVE-2026-2024 | HIGH | 7.5 | 0.5% | Feb 14, 2026 | The PhotoStack Gallery plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter in all versions up... |
| CVE-2026-2022 | MEDIUM | 4.3 | 0.3% | Feb 14, 2026 | The Smart Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t... |
| CVE-2026-1988 | HIGH | 7.5 | 0.8% | Feb 14, 2026 | The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all vers... |
| CVE-2026-1987 | MEDIUM | 5.4 | 0.3% | Feb 14, 2026 | The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i... |
| CVE-2026-1985 | MEDIUM | 6.4 | 0.3% | Feb 14, 2026 | The Press3D plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 3D Model Gutenberg block in all ve... |
| CVE-2026-1944 | MEDIUM | 5.3 | 0.3% | Feb 14, 2026 | The CallbackKiller service widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missi... |
| CVE-2026-1939 | MEDIUM | 6.4 | 0.3% | Feb 14, 2026 | The Percent to Infograph plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `percent_to_graph` sh... |
| CVE-2026-1915 | MEDIUM | 6.4 | 0.2% | Feb 14, 2026 | The Simple Plyr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poster' parameter in the 'ply... |
| CVE-2026-1910 | MEDIUM | 6.4 | 0.2% | Feb 14, 2026 | The UpMenu – Online ordering for restaurants plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '... |
| CVE-2026-1905 | MEDIUM | 6.4 | 0.2% | Feb 14, 2026 | The Sphere Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in the 's... |
| CVE-2026-1903 | MEDIUM | 6.4 | 0.2% | Feb 14, 2026 | The Ravelry Designs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout' attribute ... |
| CVE-2026-1901 | MEDIUM | 6.4 | 0.2% | Feb 14, 2026 | The QuestionPro Surveys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questionpro' shortcod... |
| CVE-2026-1796 | MEDIUM | 6.1 | 0.2% | Feb 14, 2026 | The StyleBidet plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all versions up ... |
| CVE-2026-1795 | MEDIUM | 6.1 | 0.3% | Feb 14, 2026 | The Address Bar Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL Path in all version... |
| CVE-2026-1792 | MEDIUM | 6.1 | 0.2% | Feb 14, 2026 | The Geo Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL path in all versions up to,... |
| CVE-2026-1394 | MEDIUM | 4.3 | 0.2% | Feb 14, 2026 | The WP Quick Contact Us plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl... |
| CVE-2026-1306 | CRITICAL | 9.8 | 4.5% | Feb 14, 2026 | The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension ... |
| CVE-2026-1303 | MEDIUM | 5.3 | 0.3% | Feb 14, 2026 | The MailChimp Campaigns plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including... |
| CVE-2026-1187 | MEDIUM | 6.4 | 0.2% | Feb 14, 2026 | The ZoomifyWP Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filename' parameter of the... |
| CVE-2026-1096 | MEDIUM | 6.4 | 0.2% | Feb 14, 2026 | The Best-wp-google-map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'latitude' and 'longitu... |
| CVE-2026-0753 | HIGH | 7.2 | 0.3% | Feb 14, 2026 | The Super Simple Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sscf_name' p... |
| CVE-2026-0751 | MEDIUM | 6.4 | 0.3% | Feb 14, 2026 | The Payment Page | Payment Form for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pr... |
| CVE-2026-0745 | MEDIUM | 5.5 | 0.3% | Feb 14, 2026 | The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and in... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now