CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- liton arefin master addons for elementorWordPress Master Addons for Elementor plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- really simple plugins simple sslWordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerability4.3 Medium
- themefic ultimate addons for contact form 7WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- flycart upsellwpWordPress UpsellWP plugin <= 2.2.4 - SQL Injection vulnerability7.6 High
- realmag777 wolfWordPress WOLF plugin <= 1.0.8.7 - SQL Injection vulnerability7.6 High
- wombat plugins advanced product fields (product addons) for woocommerceWordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.18 - Broken Access Control vulnerability5.3 Medium
- janis elsts admin menu editorWordPress Admin Menu Editor plugin <= 1.14.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- realmag777 mdtfWordPress MDTF plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themefusion avada coreWordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themefusion avada coreWordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability5.3 Medium
- themefusion fusion builderWordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability5.3 Medium
- themefusion fusion builderWordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability6.5 Medium
- realmag777 active products tables for woocommerceWordPress Active Products Tables for WooCommerce plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themifyme themify event postWordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- eric teubert podlove podcast publisherWordPress Podlove Podcast Publisher plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- vito peleg atarimWordPress Atarim plugin <= 4.3.2 - Broken Access Control vulnerability4.3 Medium
- syed balkhi contact form by wpformsWordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability4.3 Medium
- elementor website builderWordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability2.7 Low
- josh kohlbach product feed pro for woocommerceWordPress Product Feed PRO for WooCommerce plugin <= 13.5.2 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- e2pdfWordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerability5.0 Medium
- ex-themes wp foodWordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability5.3 Medium
- webgeniuslab bigheartsWordPress BigHearts theme <= 3.1.14 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw school educationWordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw portfolioWordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw photographyWordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw pet shopWordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw fitnessWordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerability5.3 Medium
- codepeople cp contact form with paypalWordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerability8.5 High
- codepeople wp time slots booking formWordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerability5.3 Medium
- brainstorm force astra bulk editWordPress Astra Bulk Edit plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ideabox creations powerpack addons for elementorWordPress PowerPack Addons for Elementor plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- noor alam magical addons for elementorWordPress Magical Addons For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ays pro popup like boxWordPress Popup Like box plugin <= 3.7.7 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw education liteWordPress VW Education Lite plugin <= 2.2.0 - Broken Access Control vulnerability5.3 Medium
- themelexus medilazar coreWordPress Medilazar Core plugin < 1.4.7 - Local File Inclusion vulnerability7.5 High
- linknacional payment gateway pix for givewpWordPress Payment Gateway Pix For GiveWP plugin <= 2.2.3 - Broken Access Control vulnerability5.3 Medium
- boldgrid sprout clientsWordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bowo admin and site enhancements (ase)WordPress Admin and Site Enhancements (ASE) plugin <= 8.4.0 - Broken Access Control vulnerability5.4 Medium
- levelfourdevelopment wp easycartWordPress WP EasyCart plugin <= 5.8.13 - SQL Injection vulnerability8.5 High
- agile logix post timelineWordPress Post Timeline plugin <= 2.4.1 - Broken Access Control vulnerability5.3 Medium
- ruben garcia gamipressWordPress GamiPress plugin <= 7.6.6 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- fernando briano list category postsWordPress List category posts plugin <= 0.93.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- jordy meow meow galleryWordPress Meow Gallery plugin <= 5.4.4 - SQL Injection vulnerability7.6 High
- wppochipp pochippWordPress Pochipp plugin < 1.18.9 - Broken Access Control vulnerability5.4 Medium
- bplugins pdf posterWordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability5.4 Medium
- bogdan bendziukov squeezeWordPress Squeeze plugin <= 1.7.7 - Directory Traversal vulnerability5.0 Medium
- illid advanced woo labelsWordPress Advanced Woo Labels plugin <= 2.36 - Remote Code Execution (RCE) vulnerability7.2 High
- maciej bis permalink manager liteWordPress Permalink Manager Lite plugin < 2.5.3 - Broken Access Control vulnerability5.3 Medium
- gift up! up gift cards for wordpress and woocommerceWordPress Gift Up Gift Cards for WordPress and WooCommerce plugin <= 3.1.7 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- simpma embed calendlyWordPress Embed Calendly plugin <= 4.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…