CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- aarsiv groups automated fedex live/manual rates with shipping labelsWordPress Automated FedEx live/manual rates with shipping labels plugin <= 5.1.9 - Broken Access Control vulnerability7.3 High
- pickplugins product slider for woocommerceWordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerability6.5 Medium
- mvpthemes the leagueWordPress The League theme <= 4.4.1 - Broken Access Control vulnerability6.5 Medium
- wpdo remojiWordPress Remoji plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- jonathan daggerhart widget wranglerWordPress Widget Wrangler plugin <= 2.3.9 - Remote Code Execution (RCE) vulnerability9.1 Critical
- سید محمدامین هاشمی gzseoWordPress GZSEO plugin <= 2.0.14 - Broken Access Control vulnerability6.5 Medium
- wpdevart booking calendar, appointment booking systemWordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerability7.1 High
- crm perks integration for mailchimp and contact form 7, wpforms, elementor, ninja formsWordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.2 - Broken Access Control vulnerability6.5 Medium
- wpdive nexa blocksWordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerability9.8 Critical
- metagauss profilegridWordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- iqonicdesign wpbookit proWordPress WPBookit Pro plugin <= 1.6.18 - Privilege Escalation vulnerability8.8 High
- iqonicdesign wpbookit proWordPress WPBookit Pro plugin <= 1.6.18 - Arbitrary File Upload vulnerability9.9 Critical
- themeum tutor lms proWordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability8.1 High
- arni cinco wpcargo track & traceWordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerability7.5 High
- thememount apiconaWordPress Apicona theme <= 24.1.0 - PHP Object Injection vulnerability8.8 High
- webilia vertex addons for elementorWordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerability6.5 Medium
- snowray software file uploader for woocommerceWordPress File Uploader for WooCommerce plugin <= 1.0.4 - Path Traversal vulnerability7.5 High
- coderpress commerce coinbase for woocommerceWordPress Commerce Coinbase For WooCommerce plugin <= 1.6.6 - Broken Access Control vulnerability7.5 High
- saad iqbal new user approveWordPress New User Approve plugin <= 3.2.3 - Broken Access Control vulnerability6.5 Medium
- iqonic design kivicareWordPress KiviCare plugin <= 3.6.16 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- jwsthemes idealautoWordPress IdealAuto theme < 3.8.6 - Local File Inclusion vulnerability8.1 High
- jwsthemes lovedateWordPress LoveDate theme < 3.8.6 - Local File Inclusion vulnerability8.1 High
- jwsthemes feedyWordPress Feedy theme < 2.1.5 - Local File Inclusion vulnerability8.1 High
- jwsthemes streamvidWordPress StreamVid theme < 6.8.6 - Local File Inclusion vulnerability8.1 High
- eyecix addon jobsearch chatWordPress Addon Jobsearch Chat plugin <= 3.0 - SQL Injection vulnerability9.3 Critical
- eyecix addon jobsearch chatWordPress Addon Jobsearch Chat plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- progressionstudios vayvoWordPress Vayvo - Media Streaming & Membership WordPress Theme theme < 6.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- king-theme lumise product designerWordPress Lumise Product Designer plugin < 2.0.9 - SQL Injection vulnerability9.3 Critical
- themeisle woody ad snippetsWordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability9.9 Critical
- özgür karalar kargo takipWordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability6.5 Medium
- magepeopleteam wpeventlyWordPress WpEvently plugin <= 5.1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- rascals vexWordPress Vex theme < 1.2.9 - PHP Object Injection vulnerability8.8 High
- rascals pendulumWordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerability8.8 High
- rascals melooWordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability8.8 High
- azzaroco ultimate membership proWordPress Ultimate Membership Pro plugin <= 13.7 - Account Takeover vulnerability8.1 High
- skygroup yobazarWordPress Yobazar theme < 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- skygroup sanzoWordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- skygroup reeboxWordPress Reebox theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- skygroup nooniWordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- skygroup mydecorWordPress MyDecor theme < 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- skygroup mymediWordPress MyMedi theme < 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- skygroup mitiWordPress Miti theme < 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- skygroup loobekWordPress Loobek theme < 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- acato wp rest cacheWordPress WP REST Cache plugin <= 2026.1.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- ays pro faq builder aysWordPress FAQ Builder AYS plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- gallerycreator simply galleryWordPress SimpLy Gallery plugin <= 3.3.2 - Arbitrary Code Execution vulnerability9.9 Critical
- radiustheme review schemaWordPress Review Schema plugin <= 2.2.6 - Sensitive Data Exposure vulnerability6.5 Medium
- kutethemes boutiqueWordPress Boutique theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- rsjoomla! rsfirewall!WordPress RSFirewall! plugin <= 1.1.45 - Cross Site Scripting (XSS) vulnerability7.1 High
- nootheme jobmonsterWordPress Jobmonster theme < 4.8.4 - SQL Injection vulnerability9.3 Critical
- Show moreLoading…