# CVEs published 2026-02-14

163 CVEs were published on February 14, 2026: 2 critical, 30 high. Days are UTC.

- [CVE-2026-23210](https://cve.now/CVE-2026-23210.md): ice: Fix PTP NULL pointer dereference during VSI rebuild (no CVSS, Linux)
- [CVE-2026-23209](https://cve.now/CVE-2026-23209.md): macvlan: fix error recovery in macvlan\_common\_newlink() (CVSS 7.8, Linux)
- [CVE-2026-23208](https://cve.now/CVE-2026-23208.md): ALSA: usb-audio: Prevent excessive number of frames (no CVSS, Linux)
- [CVE-2026-23207](https://cve.now/CVE-2026-23207.md): spi: tegra210-quad: Protect curr\_xfer check in IRQ handler (no CVSS, Linux)
- [CVE-2026-23206](https://cve.now/CVE-2026-23206.md): dpaa2-switch: prevent ZERO\_SIZE\_PTR dereference when num\_ifs is zero (no CVSS, Linux)
- [CVE-2026-23205](https://cve.now/CVE-2026-23205.md): smb/client: fix memory leak in smb2\_open\_file() (no CVSS, Linux)
- [CVE-2026-23204](https://cve.now/CVE-2026-23204.md): net/sched: cls\_u32: use skb\_header\_pointer\_careful() (CVSS 7.1, Linux)
- [CVE-2026-23203](https://cve.now/CVE-2026-23203.md): net: cpsw\_new: Execute ndo\_set\_rx\_mode callback in a work queue (no CVSS, Linux)
- [CVE-2026-23202](https://cve.now/CVE-2026-23202.md): spi: tegra210-quad: Protect curr\_xfer in tegra\_qspi\_combined\_seq\_xfer (no CVSS, Linux)
- [CVE-2026-23201](https://cve.now/CVE-2026-23201.md): ceph: fix oops due to invalid pointer for kfree() in parse\_longname() (no CVSS, Linux)
- [CVE-2026-23200](https://cve.now/CVE-2026-23200.md): ipv6: Fix ECMP sibling count mismatch when clearing RTF\_ADDRCONF (no CVSS, Linux)
- [CVE-2026-23199](https://cve.now/CVE-2026-23199.md): procfs: avoid fetching build ID while holding VMA lock (no CVSS, Linux)
- [CVE-2026-23198](https://cve.now/CVE-2026-23198.md): KVM: Don't clobber irqfd routing type when deassigning irqfd (CVSS 7.8, Linux)
- [CVE-2026-23197](https://cve.now/CVE-2026-23197.md): i2c: imx: preserve error state in block data length handler (no CVSS, Linux)
- [CVE-2026-23196](https://cve.now/CVE-2026-23196.md): HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer (no CVSS, Linux)
- [CVE-2026-23195](https://cve.now/CVE-2026-23195.md): cgroup/dmem: avoid pool UAF (CVSS 7.0, Linux)
- [CVE-2026-23194](https://cve.now/CVE-2026-23194.md): rust\_binder: correctly handle FDA objects of length zero (no CVSS, Linux)
- [CVE-2026-23193](https://cve.now/CVE-2026-23193.md): scsi: target: iscsi: Fix use-after-free in iscsit\_dec\_session\_usage\_count() (CVSS 8.8, Linux)
- [CVE-2026-23192](https://cve.now/CVE-2026-23192.md): linkwatch: use \_\_dev\_put() in callers to prevent UAF (CVSS 7.8, Linux)
- [CVE-2026-23191](https://cve.now/CVE-2026-23191.md): ALSA: aloop: Fix racy access at PCM trigger (CVSS 7.8, Linux)
- [CVE-2026-23190](https://cve.now/CVE-2026-23190.md): ASoC: amd: fix memory leak in acp3x pdm dma ops (no CVSS, Linux)
- [CVE-2026-23189](https://cve.now/CVE-2026-23189.md): ceph: fix NULL pointer dereference in ceph\_mds\_auth\_match() (no CVSS, Linux)
- [CVE-2026-23188](https://cve.now/CVE-2026-23188.md): net: usb: r8152: fix resume reset deadlock (no CVSS, Linux)
- [CVE-2026-23187](https://cve.now/CVE-2026-23187.md): pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-\>domains (no CVSS, Linux)
- [CVE-2026-23186](https://cve.now/CVE-2026-23186.md): hwmon: (acpi\_power\_meter) Fix deadlocks related to acpi\_power\_meter\_notify() (no CVSS, Linux)
- [CVE-2026-23185](https://cve.now/CVE-2026-23185.md): wifi: iwlwifi: mld: cancel mlo\_scan\_start\_wk (CVSS 7.8, Linux)
- [CVE-2026-23184](https://cve.now/CVE-2026-23184.md): binder: fix UAF in binder\_netlink\_report() (CVSS 7.8, Linux)
- [CVE-2026-23183](https://cve.now/CVE-2026-23183.md): cgroup/dmem: fix NULL pointer dereference when setting max (no CVSS, Linux)
- [CVE-2026-23182](https://cve.now/CVE-2026-23182.md): spi: tegra: Fix a memory leak in tegra\_slink\_probe() (no CVSS, Linux)
- [CVE-2026-23181](https://cve.now/CVE-2026-23181.md): btrfs: sync read disk super and set block size (no CVSS, Linux)
- [CVE-2026-23180](https://cve.now/CVE-2026-23180.md): dpaa2-switch: add bounds check for if\_id in IRQ handler (CVSS 7.0, Linux)
- [CVE-2026-23179](https://cve.now/CVE-2026-23179.md): nvmet-tcp: fixup hang in nvmet\_tcp\_listen\_data\_ready() (no CVSS, Linux)
- [CVE-2026-23178](https://cve.now/CVE-2026-23178.md): HID: i2c-hid: fix potential buffer overflow in i2c\_hid\_get\_report() (CVSS 7.8, Linux)
- [CVE-2026-23177](https://cve.now/CVE-2026-23177.md): mm, shmem: prevent infinite loop on truncate race (no CVSS, Linux)
- [CVE-2026-23176](https://cve.now/CVE-2026-23176.md): platform/x86: toshiba\_haps: Fix memory leaks in add/remove routines (no CVSS, Linux)
- [CVE-2026-23175](https://cve.now/CVE-2026-23175.md): net: cpsw: Execute ndo\_set\_rx\_mode callback in a work queue (CVSS 7.0, Linux)
- [CVE-2026-23174](https://cve.now/CVE-2026-23174.md): nvme-pci: handle changing device dma map requirements (no CVSS, Linux)
- [CVE-2025-71224](https://cve.now/CVE-2025-71224.md): wifi: mac80211: ocb: skip rx\_no\_sta when interface is not joined (no CVSS, Linux)
- [CVE-2025-71223](https://cve.now/CVE-2025-71223.md): smb/server: fix refcount leak in smb2\_open() (no CVSS, Linux)
- [CVE-2025-71222](https://cve.now/CVE-2025-71222.md): wifi: wlcore: ensure skb headroom before skb\_push (no CVSS, Linux)
- [CVE-2025-71221](https://cve.now/CVE-2025-71221.md): dmaengine: mmp\_pdma: Fix race condition in mmp\_pdma\_residue() (CVSS 7.8, Linux)
- [CVE-2025-71220](https://cve.now/CVE-2025-71220.md): smb/server: call ksmbd\_session\_rpc\_close() on error path in create\_smb2\_pipe() (no CVSS, Linux)
- [CVE-2025-71204](https://cve.now/CVE-2025-71204.md): smb/server: fix refcount leak in parse\_durable\_handle\_context() (CVSS 7.5, Linux)
- [CVE-2025-71203](https://cve.now/CVE-2025-71203.md): riscv: Sanitize syscall table indexing under speculation (no CVSS, Linux)
- [CVE-2026-23173](https://cve.now/CVE-2026-23173.md): net/mlx5e: TC, delete flows only for existing peers (no CVSS, Linux)
- [CVE-2026-23172](https://cve.now/CVE-2026-23172.md): net: wwan: t7xx: fix potential skb-\>frags overflow in RX path (CVSS 8.4, Linux)
- [CVE-2026-23171](https://cve.now/CVE-2026-23171.md): bonding: fix use-after-free due to enslave fail after slave array update (CVSS 7.8, Linux)
- [CVE-2026-23170](https://cve.now/CVE-2026-23170.md): drm/imx/tve: fix probe device leak (no CVSS, Linux)
- [CVE-2026-23169](https://cve.now/CVE-2026-23169.md): mptcp: fix race in mptcp\_pm\_nl\_flush\_addrs\_doit() (CVSS 7.8, Linux)
- [CVE-2026-23168](https://cve.now/CVE-2026-23168.md): flex\_proportions: make fprop\_new\_period() hardirq safe (no CVSS, Linux)
- [CVE-2026-23167](https://cve.now/CVE-2026-23167.md): nfc: nci: Fix race between rfkill and nci\_unregister\_device(). (no CVSS, Linux)
- [CVE-2026-23166](https://cve.now/CVE-2026-23166.md): ice: Fix NULL pointer dereference in ice\_vsi\_set\_napi\_queues (no CVSS, Linux)
- [CVE-2026-23165](https://cve.now/CVE-2026-23165.md): sfc: fix deadlock in RSS config read (no CVSS, Linux)
- [CVE-2026-23164](https://cve.now/CVE-2026-23164.md): rocker: fix memory leak in rocker\_world\_port\_post\_fini() (no CVSS, Linux)
- [CVE-2026-23163](https://cve.now/CVE-2026-23163.md): drm/amdgpu: fix NULL pointer dereference in amdgpu\_gmc\_filter\_faults\_remove (no CVSS, Linux)
- [CVE-2026-23162](https://cve.now/CVE-2026-23162.md): drm/xe/nvm: Fix double-free on aux add failure (no CVSS, Linux)
- [CVE-2026-23161](https://cve.now/CVE-2026-23161.md): mm/shmem, swap: fix race of truncate and swap entry split (CVSS 7.3, Linux)
- [CVE-2026-23160](https://cve.now/CVE-2026-23160.md): octeon\_ep: Fix memory leak in octep\_device\_setup() (no CVSS, Linux)
- [CVE-2026-23159](https://cve.now/CVE-2026-23159.md): perf: sched: Fix perf crash with new is\_user\_task() helper (no CVSS, Linux)
- [CVE-2026-23158](https://cve.now/CVE-2026-23158.md): gpio: virtuser: fix UAF in configfs release path (no CVSS, Linux)
- [CVE-2026-23157](https://cve.now/CVE-2026-23157.md): btrfs: do not strictly require dirty metadata threshold for metadata writepages (no CVSS, Linux)
- [CVE-2026-23156](https://cve.now/CVE-2026-23156.md): efivarfs: fix error propagation in efivar\_entry\_get() (no CVSS, Linux)
- [CVE-2026-23155](https://cve.now/CVE-2026-23155.md): can: gs\_usb: gs\_usb\_receive\_bulk\_callback(): fix error message (no CVSS, Linux)
- [CVE-2026-23154](https://cve.now/CVE-2026-23154.md): net: fix segmentation of forwarding fraglist GRO (no CVSS, Linux)
- [CVE-2026-23153](https://cve.now/CVE-2026-23153.md): firewire: core: fix race condition against transaction list (no CVSS, Linux)
- [CVE-2026-23152](https://cve.now/CVE-2026-23152.md): wifi: mac80211: correctly decode TTLM with default link map (no CVSS, Linux)
- [CVE-2026-23151](https://cve.now/CVE-2026-23151.md): Bluetooth: MGMT: Fix memory leak in set\_ssp\_complete (no CVSS, Linux)
- [CVE-2026-23150](https://cve.now/CVE-2026-23150.md): nfc: llcp: Fix memleak in nfc\_llcp\_send\_ui\_frame(). (no CVSS, Linux)
- [CVE-2026-23149](https://cve.now/CVE-2026-23149.md): drm: Do not allow userspace to trigger kernel warnings in drm\_gem\_change\_handle\_ioctl() (no CVSS, Linux)
- [CVE-2026-23148](https://cve.now/CVE-2026-23148.md): nvmet: fix race in nvmet\_bio\_done() leading to NULL pointer dereference (CVSS 7.5, Linux)
- [CVE-2026-23147](https://cve.now/CVE-2026-23147.md): btrfs: zlib: fix the folio leak on S390 hardware acceleration (no CVSS, Linux)
- [CVE-2026-23146](https://cve.now/CVE-2026-23146.md): Bluetooth: hci\_uart: fix null-ptr-deref in hci\_uart\_write\_work (no CVSS, Linux)
- [CVE-2026-23145](https://cve.now/CVE-2026-23145.md): ext4: fix iloc.bh leak in ext4\_xattr\_inode\_update\_ref (no CVSS, Linux)
- [CVE-2026-23144](https://cve.now/CVE-2026-23144.md): mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (no CVSS, Linux)
- [CVE-2026-23143](https://cve.now/CVE-2026-23143.md): virtio\_net: Fix misalignment bug in struct virtnet\_info (no CVSS, Linux)
- [CVE-2026-23142](https://cve.now/CVE-2026-23142.md): mm/damon/sysfs-scheme: cleanup access\_pattern subdirs on scheme dir setup failure (no CVSS, Linux)
- [CVE-2026-23141](https://cve.now/CVE-2026-23141.md): btrfs: send: check for inline extents in range\_is\_hole\_in\_parent() (no CVSS, Linux)
- [CVE-2025-71202](https://cve.now/CVE-2025-71202.md): iommu/sva: invalidate stale IOTLB entries for kernel address space (CVSS 8.8, Linux)
- [CVE-2026-23140](https://cve.now/CVE-2026-23140.md): bpf, test\_run: Subtract size of xdp\_frame from allowed metadata size (no CVSS, Linux)
- [CVE-2026-23139](https://cve.now/CVE-2026-23139.md): netfilter: nf\_conncount: update last\_gc only when GC has been performed (CVSS 7.5, Linux)
- [CVE-2026-23138](https://cve.now/CVE-2026-23138.md): tracing: Add recursion protection in kernel stack trace recording (no CVSS, Linux)
- [CVE-2026-23137](https://cve.now/CVE-2026-23137.md): of: unittest: Fix memory leak in unittest\_data\_add() (no CVSS, Linux)
- [CVE-2026-23136](https://cve.now/CVE-2026-23136.md): libceph: reset sparse-read state in osd\_fault() (CVSS 7.5, Linux)
- [CVE-2025-71201](https://cve.now/CVE-2025-71201.md): netfs: Fix early read unlock of page with EOF in middle (CVSS 7.1, Linux)
- [CVE-2026-23135](https://cve.now/CVE-2026-23135.md): wifi: ath12k: fix dma\_free\_coherent() pointer (no CVSS, Linux)
- [CVE-2026-23134](https://cve.now/CVE-2026-23134.md): slab: fix kmalloc\_nolock() context check for PREEMPT\_RT (no CVSS, Linux)
- [CVE-2026-23133](https://cve.now/CVE-2026-23133.md): wifi: ath10k: fix dma\_free\_coherent() pointer (no CVSS, Linux)
- [CVE-2026-23132](https://cve.now/CVE-2026-23132.md): drm/bridge: synopsys: dw-dp: fix error paths of dw\_dp\_bind (no CVSS, Linux)
- [CVE-2026-23131](https://cve.now/CVE-2026-23131.md): platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (no CVSS, Linux)
- [CVE-2026-23130](https://cve.now/CVE-2026-23130.md): wifi: ath12k: fix dead lock while flushing management frames (no CVSS, Linux)
- [CVE-2026-23129](https://cve.now/CVE-2026-23129.md): dpll: Prevent duplicate registrations (no CVSS, Linux)
- [CVE-2026-23128](https://cve.now/CVE-2026-23128.md): arm64: Set \_\_nocfi on swsusp\_arch\_resume() (no CVSS, Linux)
- [CVE-2026-23127](https://cve.now/CVE-2026-23127.md): perf: Fix refcount warning on event-\>mmap\_count increment (no CVSS, Linux)
- [CVE-2026-23126](https://cve.now/CVE-2026-23126.md): netdevsim: fix a race issue related to the operation on bpf\_bound\_progs list (no CVSS, Linux)
- [CVE-2026-23125](https://cve.now/CVE-2026-23125.md): sctp: move SCTP\_CMD\_ASSOC\_SHKEY right after SCTP\_CMD\_PEER\_INIT (no CVSS, Linux)
- [CVE-2026-23124](https://cve.now/CVE-2026-23124.md): ipv6: annotate data-race in ndisc\_router\_discovery() (no CVSS, Linux)
- [CVE-2026-23123](https://cve.now/CVE-2026-23123.md): interconnect: debugfs: initialize src\_node and dst\_node to empty strings (no CVSS, Linux)
- [CVE-2026-23122](https://cve.now/CVE-2026-23122.md): igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue (no CVSS, Linux)
- [CVE-2026-23121](https://cve.now/CVE-2026-23121.md): mISDN: annotate data-race around dev-\>work (no CVSS, Linux)
- [CVE-2026-23120](https://cve.now/CVE-2026-23120.md): l2tp: avoid one data-race in l2tp\_tunnel\_del\_work() (no CVSS, Linux)
- [CVE-2026-23119](https://cve.now/CVE-2026-23119.md): bonding: provide a net pointer to \_\_skb\_flow\_dissect() (no CVSS, Linux)
- [CVE-2026-23118](https://cve.now/CVE-2026-23118.md): rxrpc: Fix data-race warning and potential load/store tearing (no CVSS, Linux)
- [CVE-2026-23117](https://cve.now/CVE-2026-23117.md): ice: add missing ice\_deinit\_hw() in devlink reinit path (no CVSS, Linux)
- [CVE-2026-23116](https://cve.now/CVE-2026-23116.md): pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (no CVSS, Linux)
- [CVE-2026-23115](https://cve.now/CVE-2026-23115.md): serial: Fix not set tty-\>port race condition (no CVSS, Linux)
- [CVE-2026-23114](https://cve.now/CVE-2026-23114.md): arm64/fpsimd: ptrace: Fix SVE writes on !SME systems (no CVSS, Linux)
- [CVE-2026-23113](https://cve.now/CVE-2026-23113.md): io\_uring/io-wq: check IO\_WQ\_BIT\_EXIT inside work run loop (no CVSS, Linux)
- [CVE-2025-71200](https://cve.now/CVE-2025-71200.md): mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (no CVSS, Linux)
- [CVE-2026-2312](https://cve.now/CVE-2026-2312.md): Media Library Folders \<= 8.3.6 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename (CVSS 4.3, maxfoundry Media Library Folders)
- [CVE-2026-1512](https://cve.now/CVE-2026-1512.md): Essential Addons for Elementor \<= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2026-1258](https://cve.now/CVE-2026-1258.md): Mail Mint \<= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints (CVSS 4.9, getwpfunnels Mail Mint – Email Marketing, Newsletter, Email…)
- [CVE-2026-0550](https://cve.now/CVE-2026-0550.md): myCred \<= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred\_load\_coupon' Shortcode (CVSS 6.4, saadiqbal Points Management System For Gamification, Ranks,…)
- [CVE-2025-8572](https://cve.now/CVE-2025-8572.md): Truelysell Core \<= 1.8.7 - Unauthenticated Privilege Escalation via Registration (CVSS 9.8, dreamstechnologies Truelysell Core)
- [CVE-2026-1843](https://cve.now/CVE-2026-1843.md): Super Page Cache \<= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Log (CVSS 7.2, optimole Super Page Cache)
- [CVE-2026-1254](https://cve.now/CVE-2026-1254.md): Modula Image Gallery – Photo Grid & Video Gallery \<= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing (CVSS 4.3, wpchill Modula Image Gallery – Photo Grid & Video Gallery)
- [CVE-2026-1249](https://cve.now/CVE-2026-1249.md): MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery (CVSS 5.0, MP3 Audio Player – Music Player, Podcast Player & Radio by…)
- [CVE-2026-1988](https://cve.now/CVE-2026-1988.md): Flexi Product Slider and Grid for WooCommerce \<= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute (CVSS 7.5, wpdecent Flexi Product Slider and Grid for WooCommerce)
- [CVE-2026-1987](https://cve.now/CVE-2026-1987.md): Scheduler Widget \<= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification (CVSS 5.4, morelmathieuj Scheduler Widget)
- [CVE-2026-0736](https://cve.now/CVE-2026-0736.md): Chatbot for WordPress by Collect.chat ⚡️ \<= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Field (CVSS 6.4, collectchat Chatbot for WordPress by Collect.chat ⚡️)
- [CVE-2026-1187](https://cve.now/CVE-2026-1187.md): ZoomifyWP Free \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute (CVSS 6.4, terrazoom ZoomifyWP Free)
- [CVE-2026-1915](https://cve.now/CVE-2026-1915.md): Simple Plyr \<= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute (CVSS 6.4, bestony Simple Plyr)
- [CVE-2026-1985](https://cve.now/CVE-2026-1985.md): Press3D \<= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block (CVSS 6.4, arieslab Press3D)
- [CVE-2026-0753](https://cve.now/CVE-2026-0753.md): Super Simple Contact Form \<= 1.6.2 - Reflected Cross-Site Scripting via 'sscf\_name' Parameter (CVSS 7.2, bitacre Super Simple Contact Form)
- [CVE-2026-1306](https://cve.now/CVE-2026-1306.md): midi-Synth \<= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action (CVSS 9.8, adminkov midi-Synth)
- [CVE-2026-0735](https://cve.now/CVE-2026-0735.md): User Language Switch \<= 1.6.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab\_color\_picker\_language\_switch' Parameter (CVSS 4.4, webilop User Language Switch)
- [CVE-2025-15483](https://cve.now/CVE-2025-15483.md): Link Hopper \<= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop\_name' Parameter (CVSS 4.4, ajferg Link Hopper)
- [CVE-2026-1303](https://cve.now/CVE-2026-1303.md): MailChimp Campaigns \<= 3.2.4 - Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection (CVSS 5.3, matthieuscarset MailChimp Campaigns)
- [CVE-2026-1910](https://cve.now/CVE-2026-1910.md): UpMenu \<= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute (CVSS 6.4, UpMenu – Online ordering for restaurants)
- [CVE-2026-0693](https://cve.now/CVE-2026-0693.md): Allow HTML in Category Descriptions \<= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions (CVSS 4.4, arnoesterhuizen Allow HTML in Category Descriptions)
- [CVE-2026-1096](https://cve.now/CVE-2026-1096.md): Best-wp-google-map \<= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute (CVSS 6.4, raju\_ahmed Best-wp-google-map)
- [CVE-2026-0559](https://cve.now/CVE-2026-0559.md): MasterStudy LMS WordPress Plugin – for Online Courses and Education \<= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm\_lms\_courses\_grid\_display' Shortcode (CVSS 6.4, stylemix MasterStudy LMS WordPress Plugin – for Online Cour…)
- [CVE-2026-1394](https://cve.now/CVE-2026-1394.md): WP Quick Contact Us \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, dmitritechs WP Quick Contact Us)
- [CVE-2026-1905](https://cve.now/CVE-2026-1905.md): Sphere Manager \<= 1.0.2 - Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute (CVSS 6.4, devmw Sphere Manager)
- [CVE-2025-14852](https://cve.now/CVE-2025-14852.md): MDirector Newsletter \<= 4.5.8 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, antevenio MDirector Newsletter WordPress Plugin)
- [CVE-2026-1944](https://cve.now/CVE-2026-1944.md): CallbackKiller service widget \<= 1.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update (CVSS 5.3, krellbat CallbackKiller service widget)
- [CVE-2026-0557](https://cve.now/CVE-2026-0557.md): WP Data Access \<= 5.5.63 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda\_app' Shortcode (CVSS 6.4, peterschulznl WP Data Access – App Builder for Tables, Form…)
- [CVE-2026-2024](https://cve.now/CVE-2026-2024.md): PhotoStack Gallery \<= 0.4.1 - Unauthenticated SQL Injection via 'postid' Parameter (CVSS 7.5, savitasoni PhotoStack Gallery)
- [CVE-2026-1939](https://cve.now/CVE-2026-1939.md): Percent to Infograph \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, cutesalah Percent to Infograph)
- [CVE-2026-1795](https://cve.now/CVE-2026-1795.md): Address Bar Ads \<= 1.0.0 - Reflected Cross-Site Scripting (CVSS 6.1, sivenso Address Bar Ads)
- [CVE-2026-1903](https://cve.now/CVE-2026-1903.md): Ravelry Designs Widget \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb\_ravelry\_designs' Shortcode 'layout' Attribute (CVSS 6.4, shellbot Ravelry Designs Widget)
- [CVE-2026-1792](https://cve.now/CVE-2026-1792.md): Geo Widet \<= 1.0 - Reflected Cross-Site Scripting (CVSS 6.1, owencutajar Geo Widget)
- [CVE-2026-0745](https://cve.now/CVE-2026-0745.md): User Language Switch \<= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info\_language' Parameter (CVSS 5.5, webilop User Language Switch)
- [CVE-2026-2022](https://cve.now/CVE-2026-2022.md): Smart Forms \<= 2.6.99 - Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure (CVSS 4.3, edgarrojas Smart Forms – when you need more than just a con…)
- [CVE-2026-1901](https://cve.now/CVE-2026-1901.md): QuestionPro Surveys \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, QuestionPro Surveys)
- [CVE-2025-14873](https://cve.now/CVE-2025-14873.md): LatePoint – Calendar Booking Plugin for Appointments and Events \<= 5.2.5 - Cross-Site Request Forgery (CVSS 4.3, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2026-0727](https://cve.now/CVE-2026-0727.md): Accordion and Accordion Slider \<= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification (CVSS 5.4, essentialplugin Accordion and Accordion Slider)
- [CVE-2026-0751](https://cve.now/CVE-2026-0751.md): Payment Page | Payment Form for Stripe \<= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'pricing\_plan\_select\_text\_font\_family' Parameter (CVSS 6.4, brandonfire Payment Page | Payment Form for Stripe)
- [CVE-2025-6792](https://cve.now/CVE-2025-6792.md): One to one user Chat by WPGuppy \<= 1.1.4 - Unauthenticated Information Disclosure via Chat Message Interception (CVSS 5.3, amentotechpvtltd One to one user Chat by WPGuppy)
- [CVE-2026-1796](https://cve.now/CVE-2026-1796.md): StyleBidet \<= 1.0.0 - Reflected Cross-Site Scripting (CVSS 6.1, indextwo StyleBidet)
- [CVE-2026-1932](https://cve.now/CVE-2026-1932.md): Appointment Booking Calendar Plugin \<= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary Appointment Status Modification (CVSS 5.3, bssoftware Appointment Booking Calendar Plugin – Bookr)
- [CVE-2026-2469](https://cve.now/CVE-2026-2469.md): Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used (CVSS 7.2, directorytree/imapengine)
- [CVE-2026-0692](https://cve.now/CVE-2026-0692.md): BlueSnap Payment Gateway for WooCommerce \<= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation (CVSS 7.5, BlueSnap Payment Gateway for WooCommerce)
- [CVE-2026-1912](https://cve.now/CVE-2026-1912.md): Citations tools \<= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute (CVSS 6.4, ulaulaman Citations tools)
- [CVE-2026-1983](https://cve.now/CVE-2026-1983.md): SEATT: Simple Event Attendance \<= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion (CVSS 4.3, sourcez SEATT: Simple Event Attendance)
- [CVE-2026-1164](https://cve.now/CVE-2026-1164.md): Easy Voice Mail \<= 1.2.5 - Unauthenticated Stored Cross-Site Scripting via 'message' (CVSS 6.1, phoenixstudiodz Easy Voice Mail)
- [CVE-2026-1904](https://cve.now/CVE-2026-1904.md): Simple Wp colorfull Accordion \<= 1.0 - Authenticated (Contributor+) Cross-Site Scripting via 'title' Shortcode Attribute (CVSS 6.4, nayon46 Simple Wp colorfull Accordion)
- [CVE-2026-1754](https://cve.now/CVE-2026-1754.md): personal-authors-category \<= 0.3 - Reflected Cross-Site Scripting (CVSS 6.1, alexeyknyazev personal-authors-category)
- [CVE-2026-2144](https://cve.now/CVE-2026-2144.md): Magic Login Mail or QR Code \<= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage (CVSS 8.1, katsushi-kawamori Magic Login Mail or QR Code)
- [CVE-2026-2027](https://cve.now/CVE-2026-2027.md): AMP Enhancer \<= 1.0.49 - Authenticated (Administrator+) Stored Cross-Site Scripting via AMP Custom CSS Setting (CVSS 4.4, ampenhancer AMP Enhancer – Compatibility Layer for Official…)
- [CVE-2025-14608](https://cve.now/CVE-2025-14608.md): WP Last Modified Info \<= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification (CVSS 5.3, infosatech WP Last Modified Info)
- [CVE-2025-14067](https://cve.now/CVE-2025-14067.md): Easy Form Builder \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure (CVSS 5.3, hassantafreshi Easy Form Builder by WhiteStudio — Drag & Dr…)
- [CVE-2025-13973](https://cve.now/CVE-2025-13973.md): StickEasy Protected Contact Form \<= 1.0.1 - Unauthenticated Information Disclosure (CVSS 5.3, kasuga16 StickEasy Protected Contact Form)
- [CVE-2025-13681](https://cve.now/CVE-2025-13681.md): BFG Tools – Extension Zipper \<= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first\_file' Parameter (CVSS 4.9, thebaldfatguy BFG Tools – Extension Zipper)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-02-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.