CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- syed balkhi contact form by wpformsWordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability6.5 Medium
- wordpresschef salon booking system proWordPress Salon Booking System Pro plugin < 10.30.12 - Account Takeover vulnerability8.1 High
- add-ons.org product file upload for woocommerceWordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerability6.8 Medium
- rustaurius five star restaurant reservationsWordPress Five Star Restaurant Reservations plugin <= 2.7.9 - Broken Access Control vulnerability6.5 Medium
- tychesoftwares print invoice & delivery notes for woocommerceWordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.9.0 - Broken Access Control vulnerability7.5 High
- publishpress authorsWordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability7.5 High
- 8theme xstore coreWordPress XStore Core plugin <= 5.6.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- skygroup jarotiWordPress Jaroti theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wasiliy strecker / contestgallery developer contest galleryWordPress Contest Gallery plugin <= 28.1.2.2 - Account Takeover vulnerability9.8 Critical
- iqonic design kivicareWordPress KiviCare plugin <= 3.6.16 - Broken Access Control vulnerability6.5 Medium
- uixthemes motta addonsWordPress Motta Addons plugin < 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- park of ideas rickyWordPress Ricky theme < 2.31 - PHP Object Injection vulnerability9.8 Critical
- park of ideas tasty dailyWordPress Tasty Daily theme < 1.27 - PHP Object Injection vulnerability9.8 Critical
- park of ideas goldishWordPress Goldish theme < 3.47 - PHP Object Injection vulnerability9.8 Critical
- park of ideas kidzWordPress KIDZ theme <= 5.24 - PHP Object Injection vulnerability9.8 Critical
- radiustheme teamWordPress Team plugin <= 5.0.11 - Broken Access Control vulnerability7.5 High
- e4jvikwp vikrestaurantsWordPress VikRestaurants plugin <= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- stmcan naturalife extensionsWordPress NaturaLife Extensions plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- stmcan naturalife extensionsWordPress NaturaLife Extensions plugin <= 2.1 - Local File Inclusion vulnerability8.1 High
- whmcsdes phox hostingWordPress Phox Hosting plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- raratheme education zoneWordPress Education Zone theme <= 1.3.8 - Broken Access Control vulnerability6.5 Medium
- element invader elementinvader addons for elementorWordPress ElementInvader Addons for Elementor plugin <= 1.4.2 - SQL Injection vulnerability8.5 High
- thimpress learnpress – sepay paymentWordPress LearnPress – Sepay Payment plugin <= 4.0.0 - Broken Authentication vulnerability7.5 High
- saad iqbal post snippetsWordPress Post Snippets plugin <= 4.0.12 - Remote Code Execution (RCE) vulnerability8.5 High
- wpfactory advanced woocommerce product sales reportingWordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.3 - SQL Injection vulnerability9.3 Critical
- fantasticplugins sumo affiliates proWordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerability9.8 Critical
- activity-log.com wp system logWordPress WP System Log plugin <= 1.2.7 - Broken Access Control vulnerability6.5 Medium
- upsolution coreWordPress UpSolution Core plugin <= 8.41 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- nootheme visionary coreWordPress Visionary Core plugin <= 1.4.9 - PHP Object Injection vulnerability8.8 High
- nootheme visionary coreWordPress Visionary Core plugin <= 1.4.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- nootheme jobica coreWordPress Jobica Core plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- nootheme jobica coreWordPress Jobica Core plugin <= 1.4.1 - PHP Object Injection vulnerability8.8 High
- nootheme organici libraryWordPress Organici Library plugin <= 2.1.2 - SQL Injection vulnerability8.5 High
- nootheme organici libraryWordPress Organici Library plugin <= 2.1.2 - PHP Object Injection vulnerability8.8 High
- nootheme organici libraryWordPress Organici Library plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- nootheme citilightsWordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerability8.8 High
- nootheme citilightsWordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- elated-themes elated listingWordPress Elated Listing plugin <= 1.4 - Broken Access Control vulnerability6.5 Medium
- elated-themes search & goWordPress Search & Go theme <= 2.8 - Privilege Escalation vulnerability9.8 Critical
- designingmedia energoxWordPress Energox theme <= 1.2 - Arbitrary File Deletion vulnerability7.7 High
- designingmedia instant vaWordPress Instant VA theme <= 1.0.1 - Arbitrary File Deletion vulnerability7.7 High
- xagio seo seoWordPress Xagio SEO plugin <= 7.1.0.30 - Privilege Escalation vulnerability9.8 Critical
- wasiliy strecker / contestgallery developer contest galleryWordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- thememakers car dealerWordPress Car Dealer theme <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wproyal news magazine xWordPress News Magazine X theme <= 1.2.50 - Broken Access Control vulnerability7.5 High
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability9.8 Critical
- javier casares wpvulnerabilityWordPress WPVulnerability plugin <= 4.2.1 - Broken Access Control vulnerability6.5 Medium
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerability8.1 High
- wp swings subscriptions for woocommerceWordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability7.5 High
- theme-one the gridWordPress The Grid plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…