CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- bplugins icon list blockWordPress Icon List Block plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpdevelop booking calendarWordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability7.6 High
- katsushi kawamori simple blog cardWordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- robosoft robo galleryWordPress Robo Gallery plugin <= 5.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetengineWordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability8.8 High
- magepeopleteam wpeventlyWordPress WpEvently plugin < 5.1.9 - Sensitive Data Exposure vulnerability5.3 Medium
- mailerpress team mailerpressWordPress MailerPress plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- elementor website builderWordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- blubrry powerpress podcastingWordPress PowerPress Podcasting plugin <= 11.15.13 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpradiant chocolate houseWordPress Chocolate House theme <= 1.1.5 - Broken Access Control vulnerability5.3 Medium
- andy fragen embed pdf viewerWordPress Embed PDF Viewer plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- madrasthemes mas videosWordPress MAS Videos plugin <= 1.3.2 - Broken Access Control vulnerability5.3 Medium
- raratheme restaurant and cafeWordPress Restaurant and Cafe theme <= 1.2.5 - Broken Access Control vulnerability5.3 Medium
- raratheme travel agencyWordPress Travel Agency theme <= 1.5.5 - Broken Access Control vulnerability5.3 Medium
- raratheme perfect portfolioWordPress Perfect Portfolio theme <= 1.2.4 - Broken Access Control vulnerability5.3 Medium
- desertthemes corpivaWordPress Corpiva theme <= 1.0.96 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- magazine3 easy table of contentsWordPress Easy Table of Contents plugin <= 2.0.80 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- ays pro quiz makerWordPress Quiz Maker plugin <= 6.7.1.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- raratheme benevolentWordPress Benevolent theme <= 1.3.9 - Broken Access Control vulnerability5.3 Medium
- raratheme business one pageWordPress Business One Page theme <= 1.3.2 - Broken Access Control vulnerability5.3 Medium
- raratheme bakes and cakesWordPress Bakes And Cakes theme <= 1.2.9 - Broken Access Control vulnerability5.3 Medium
- raratheme construction landing pageWordPress Construction Landing Page theme <= 1.4.1 - Broken Access Control vulnerability5.3 Medium
- raratheme preschool and kindergartenWordPress Preschool and Kindergarten theme <= 1.2.5 - Broken Access Control vulnerability5.3 Medium
- raratheme rara businessWordPress Rara Business theme <= 1.3.0 - Broken Access Control vulnerability5.3 Medium
- raratheme the conferenceWordPress The Conference theme <= 1.2.5 - Broken Access Control vulnerability5.3 Medium
- raratheme jobscoutWordPress JobScout theme <= 1.1.7 - Broken Access Control vulnerability5.3 Medium
- ays pro easy formWordPress Easy Form plugin <= 2.7.9 - Broken Access Control vulnerability5.3 Medium
- israpil textmetricsWordPress Textmetrics plugin <= 3.6.4 - Broken Access Control vulnerability5.4 Medium
- 10web photo gallery by 10webWordPress Photo Gallery by 10Web plugin <= 1.8.37 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- ays pro advanced related postsWordPress Advanced Related Posts plugin <= 1.9.1 - Broken Access Control vulnerability5.3 Medium
- shufflehound lemmonyWordPress Lemmony theme < 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- ays pro fox lmsWordPress Fox LMS plugin <= 1.0.6.3 - SQL Injection vulnerability8.5 High
- josh kohlbach advanced coupons for woocommerce couponsWordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1 - Broken Access Control vulnerability4.3 Medium
- immonex kickstartWordPress immonex Kickstart plugin <= 1.13.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wedevs wp erpWordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerability8.5 High
- iulia cazan latest post shortcodeWordPress Latest Post Shortcode plugin <= 14.2.1 - Broken Access Control vulnerability5.3 Medium
- ux-themes flatsomeWordPress Flatsome theme <= 3.19.6 - Broken Access Control vulnerability5.3 Medium
microcode_ctlTuxCareUpdate of microcode_ctlNo scoremicrocode_ctlTuxCareUpdate of microcode_ctlNo score- checkmkUnauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint6.3 Medium
- checkmkAuthenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint5.3 Medium
- wpzoom social icons widget & block – social media icons & share buttonsSocial Icons Widget & Block <= 4.5.8 - Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation4.3 Medium
- erlang otp, erlang\/inets, erlang\/otp +2 moreRequest smuggling via first-wins Content-Length parsing in inets httpd7.0 High
- erlang otp, erlang\/otp, erlang\/ssh +2 morePre-auth SSH DoS via unbounded zlib inflate6.9 Medium
- erlang otp, erlang\/otp, erlang\/ssh +2 moreSFTP root escape via component-agnostic prefix check in ssh_sftpd5.3 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +4 more +6 moreSystemd: systemd: privilege escalation via improper access control in registermachine d-bus method6.7 Medium
- pointsharp id serverBroken access control vulnerability affecting ID Server8.8 High
- codepeople calculated fields formCalculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings6.4 Medium
- strategy11team formidable forms – contact form plugin, survey, quiz, payment, calculator form & custom form builderFormidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter5.3 Medium
- roxnor getgenie – ai content writer with keyword research & seo tracking toolsGetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion5.4 Medium
- Show moreLoading…