2026 CVE Vulnerabilities
83,689 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-1885 | MEDIUM | 6.4 | 0.2% | Feb 11, 2026 | The Slideshow Wp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sswpid' attribute of the 'ss... |
| CVE-2026-1853 | MEDIUM | 6.4 | 0.2% | Feb 11, 2026 | The BuddyHolis ListSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listsearch... |
| CVE-2026-1833 | MEDIUM | 5.3 | 0.3% | Feb 11, 2026 | The WaMate Confirm – Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to,... |
| CVE-2026-1827 | MEDIUM | 6.4 | 0.2% | Feb 11, 2026 | The Flask Micro code-editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's codeflask... |
| CVE-2026-1826 | MEDIUM | 6.4 | 0.3% | Feb 11, 2026 | The OpenPOS Lite – Point of Sale for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... |
| CVE-2026-1821 | MEDIUM | 6.4 | 0.2% | Feb 11, 2026 | The Microtango plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'restkey' parameter of the mt_r... |
| CVE-2026-1809 | MEDIUM | 6.4 | 0.3% | Feb 11, 2026 | The HTML Tag Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in... |
| CVE-2026-1804 | MEDIUM | 6.4 | 0.2% | Feb 11, 2026 | The WDES Responsive Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdes-popup... |
| CVE-2026-1786 | MEDIUM | 6.5 | 0.3% | Feb 11, 2026 | The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capab... |
| CVE-2026-1748 | MEDIUM | 4.3 | 0.3% | Feb 11, 2026 | The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data du... |
| CVE-2026-1560 | HIGH | 8.8 | 9.1% | Feb 11, 2026 | The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to... |
| CVE-2026-1215 | MEDIUM | 4.3 | 0.2% | Feb 11, 2026 | The MMA Call Tracking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ... |
| CVE-2026-0815 | MEDIUM | 4.4 | 0.2% | Feb 11, 2026 | The Category Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag-image' parameter in al... |
| CVE-2026-0724 | MEDIUM | 4.4 | 0.3% | Feb 11, 2026 | The WPlyr Media Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_wplyr_accent_color' pa... |
| CVE-2026-1357 | CRITICAL | 9.8 | 32.7% | Feb 11, 2026 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitr... |
| CVE-2026-1235 | MEDIUM | 6.5 | 0.3% | Feb 11, 2026 | The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthentic... |
| CVE-2026-26079 | MEDIUM | 4.7 | 0.3% | Feb 11, 2026 | Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comme... |
| CVE-2026-26044 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26043 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26042 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26041 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26040 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26039 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26038 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26037 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now