CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- link software llc wp terms popupWordPress WP Terms Popup plugin <= 2.10.0 - Broken Access Control vulnerability7.5 High
- ays pro image slider by aysWordPress Image Slider by Ays plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- eyecix jobsearchWordPress JobSearch plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- joe dolson my ticketsWordPress My Tickets plugin <= 2.1.1 - Bypass Vulnerability vulnerability5.3 Medium
- jgwhite33 wp review sliderWordPress WP Review Slider plugin <= 13.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jgwhite33 wp tripadvisor review sliderWordPress WP TripAdvisor Review Slider plugin <= 14.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins b blocksWordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability6.5 Medium
- wpeverest user registrationWordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability8.1 High
- wedevs wp user frontendWordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability7.5 High
- boldgrid weformsWordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability8.8 High
- codepeople contact form emailWordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerability6.5 Medium
- deothemes onaWordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability9.9 Critical
- webtoffee comments import & exportWordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerability7.7 High
- devteam haywoodtech product rearrange for woocommerceWordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability8.2 High
- devteam haywoodtech product rearrange for woocommerceWordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - SQL Injection vulnerability9.3 Critical
- hookandhook wp courses lmsWordPress WP Courses LMS plugin <= 3.2.26 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- whitebox-studio scapeWordPress Scape theme < 1.5.16 - Arbitrary File Deletion vulnerability8.6 High
- magepeople inc. bus ticket booking with seat reservationWordPress Bus Ticket Booking with Seat Reservation plugin <= 5.6.0 - PHP Object Injection vulnerability9.8 Critical
- g5theme darna frameworkWordPress Darna Framework plugin <= 2.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- g5theme wolverine frameworkWordPress Wolverine Framework plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themerex buissonWordPress Buisson theme <= 1.1.11 - PHP Object Injection vulnerability9.8 Critical
- themerex work & travel companyWordPress Work & Travel Company theme <= 1.2 - PHP Object Injection vulnerability9.8 Critical
- themerex love storyWordPress Love Story theme <= 1.3.12 - PHP Object Injection vulnerability9.8 Critical
- mikado-themes rosebudWordPress Rosebud theme <= 1.4 - Local File Inclusion vulnerability8.1 High
- mikado-themes destonWordPress Deston theme <= 1.0 - Local File Inclusion vulnerability8.1 High
- mikado-themes amfissaWordPress Amfissa theme <= 1.1 - Local File Inclusion vulnerability8.1 High
- mikado-themes emaurriWordPress Emaurri theme <= 1.0.1 - Local File Inclusion vulnerability8.1 High
- mikado-themes multiofficeWordPress MultiOffice theme <= 1.2 - Local File Inclusion vulnerability8.1 High
- mikado-themes luxedriveWordPress LuxeDrive theme <= 1.0 - Local File Inclusion vulnerability8.1 High
- mikado-themes belfortWordPress Belfort theme <= 1.0 - Local File Inclusion vulnerability8.1 High
- addi – cuotas que se adaptan a tiWordPress Addi – Cuotas que se adaptan a ti plugin <= 2.0.4 - Broken Authentication vulnerability7.5 High
- arraytics wpcafeWordPress WPCafe plugin <= 3.0.7 - Broken Access Control vulnerability9.1 Critical
- pencidesign penci soledad data migratorWordPress Penci Soledad Data Migrator plugin <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- uxper goloWordPress Golo theme <= 1.7.0 - Privilege Escalation vulnerability9.8 Critical
- nootheme jobica coreWordPress Jobica Core plugin <= 1.4.2 - Account Takeover vulnerability9.8 Critical
- elated-themes the aisle coreWordPress The Aisle Core plugin <= 2.0.5 - Local File Inclusion vulnerability8.1 High
- mikado-themes curly coreWordPress Curly Core plugin <= 2.1.6 - Local File Inclusion vulnerability8.1 High
- kaira storecustomizerWordPress StoreCustomizer plugin <= 2.6.3 - Broken Access Control vulnerability6.5 Medium
- sbthemes woocommerce infinite scrollWordPress WooCommerce Infinite Scroll plugin <= 1.6.2 - PHP Object Injection vulnerability8.8 High
- totalsuite total poll liteWordPress Total Poll Lite plugin <= 4.12.0 - Remote Code Execution (RCE) vulnerability9.9 Critical
- aa-team wzoneWordPress WZone plugin <= 14.0.31 - Arbitrary File Deletion vulnerability8.8 High
- aa-team wzoneWordPress WZone plugin <= 14.0.31 - SQL Injection vulnerability8.5 High
- viabill for woocommerce – woocommerceWordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerability6.5 Medium
- codepeople cp multi view event calendarWordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tielabs jannahWordPress Jannah theme <= 7.6.4 - Local File Inclusion vulnerability8.1 High
- avalexWordPress avalex plugin <= 3.1.3 - Broken Access Control vulnerability6.5 Medium
- purethemes listeo coreWordPress Listeo Core plugin <= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- liquidthemes ave coreWordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerability6.3 Medium
- select-themes momentsWordPress Moments theme <= 2.2 - Local File Inclusion vulnerability8.1 High
- select-themes mixtapeWordPress Mixtape theme <= 2.1 - Local File Inclusion vulnerability8.1 High
- Show moreLoading…