CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- kazunii itsukaitaitsukaita <= 0.1.2 - Reflected Cross-Site Scripting via 'day_from' Parameter6.1 Medium
- tstachl wordpress paypal donationWordPress PayPal Donation <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute6.4 Medium
- forfront e-shote-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action5.3 Medium
- minhnhut link gatewayMinhNhut Link Gateway <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- sam perrow pre* party resource hintsPre* Party Resource Hints <= 1.8.20 - Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter6.5 Medium
- invelity product feedsInvelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion8.1 High
- frankkoenen plugin name: login registerlogin_register <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting4.3 Medium
- reputeinfosystems contact form, survey, quiz & popup form builder – arformsContact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution5.6 Medium
- tonyh-1 sheets2tableSheets2Table <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute6.4 Medium
- chuckmo lobot slider administratorLobot Slider Administrator <= 0.6.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- eagerterrier mimetypes link iconsMimeTypes Link Icons <= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content8.3 High
- vagaro booking widgetVagaro Booking Widget <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code'7.2 High
- superrishi sr wp minify htmlSR WP Minify HTML <= 2.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- appmaxplataforma appmaxAppmax <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint5.3 Medium
- xjb rest api to miniprogramREST API TO MiniProgram <= 5.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter5.3 Medium
- sammyb wp games embedWP Games Embed <= 0.1beta - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- xhanch studio – my advanced settingsXhanch - My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update4.3 Medium
- quentn wp, quentn.com gmbh quentn wp +1 moreQuentn WP <= 1.2.12 - Unauthenticated SQL Injection via 'qntn_wp_access' Cookie7.5 High
- admintwentytwenty uipress lite | effortless custom dashboards, admin themes and pagesUiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update4.3 Medium
- hakeemnala build app onlineBuild App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action5.3 Medium
- itpathsolutions any post sliderAny Post Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute6.4 Medium
- atomchat group chat & video chat by atomchatGroup Chat & Video Chat by AtomChat <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update4.3 Medium
- tourcms tour & activity operator plugin for tourcmsTour & Activity Operator Plugin for TourCMS <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- brainstation23 company posts for linkedinCompany Posts for LinkedIn <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Deletion4.3 Medium
- checkbox surveySurvey <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings4.4 Medium
- dogrow simple football scoreboardSimple Football Scoreboard <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- hrs2015 go night pro | wordpress dark mode pluginGo Night Pro | WordPress Dark Mode Plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute6.4 Medium
- pftool alfie – feed pluginAlfie – Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter6.1 Medium
- axton wp-webauthnWP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- waianaeboy702 ed's font awesomeEd's Font Awesome <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- applixir reward video ad for wordpressReward Video Ad for WordPress <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings4.4 Medium
- charlycharm speedup optimizationSpeedup Optimization <= 1.5.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01_enabled' AJAX Action4.3 Medium
- cbednarek fyyd podcast shortcodesfyyd podcast shortcodes <= 0.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute6.4 Medium
- jurajsim post affiliate proPost Affiliate Pro <= 1.28.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field3.8 Low
- creativewerkdesigns wpfaqblock– faq & accordion plugin for gutenbergWPFAQBlock– FAQ & Accordion Plugin For Gutenberg <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute6.4 Medium
- nocaredev ad shortAd Short <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attribute6.4 Medium
- larrykim wp-chatbot for messengerWP-Chatbot for Messenger <= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration Takeover5.3 Medium
- larsdrasmussen rexcrawlerrexCrawler <= 1.0.15 - Reflected Cross-Site Scripting via 'url' and 'regex' Parameters6.1 Medium
- outgrowOutgrow <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute6.4 Medium
- miguelmartinezlopez ecover builder for dummiesEcover Builder For Dummies <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4 Medium
- deckercz ivysilani shortcodeiVysilani Shortcode <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute6.4 Medium
- haghs redirect countdownRedirect countdown <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- omarnas add google social profiles to knowledge graph boxAdd Google Social Profiles to Knowledge Graph Box <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- suifengtec wp posts re-orderWP Posts Re-order <= 1.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- nosoycesaros post flaggerPost Flagger <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute6.4 Medium
- plugli linksy search and replaceLinksy Search and Replace <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via linksy_search_and_replace_item_details8.8 High
- tonysamperi wp ng weatherWP NG Weather <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- newbiesup wp random buttonWP Random Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute6.4 Medium
- appcheap app builder – create native android & ios apps on the flightApp Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter6.5 Medium
- devsoftbaltic surveyjs: drag & drop form builderSurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting7.2 High
- Show moreLoading…