CVEs published in March 2026
6,551 vulnerabilities, 676 critical, 10 exploited.
- stellarwp restrict contentWordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerability7.5 High
- taboola pixelWordPress Taboola Pixel plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- oopspam team anti-spamWordPress OOPSpam Anti-Spam plugin <= 1.2.62 - Cross Site Scripting (XSS) vulnerability7.1 High
- themefusion fusion builderWordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- premmerce redirect managerWordPress Premmerce Redirect Manager plugin <= 1.0.12 - Broken Access Control vulnerability6.5 Medium
- booklyWordPress Bookly plugin <= 26.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- publishpress revisionsWordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerability9.3 Critical
- noor alam smtp mailerWordPress SMTP Mailer plugin <= 1.1.24 - Sensitive Data Exposure vulnerability7.5 High
- nk visual portfolio, photo gallery & post gridWordPress Visual Portfolio, Photo Gallery & Post Grid plugin <= 3.5.1 - Local File Inclusion vulnerability7.5 High
- halfdata green downloadsWordPress Green Downloads plugin <= 2.08 - Arbitrary File Upload vulnerability9.9 Critical
- joomsky js help deskWordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- joomsky js help deskWordPress JS Help Desk plugin <= 3.0.3 - SQL Injection vulnerability8.5 High
- latepointWordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- themehunk contact form & lead form elementor builderWordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- gavias kuncoWordPress Kunco theme < 1.4.5 - Local File Inclusion vulnerability8.1 High
- wpfunnels creator lmsWordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerability8.8 High
- don-themes mollaWordPress Molla theme < 1.5.19 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- don-themes riodeWordPress Riode | Multi-Purpose WooCommerce theme < 1.6.29 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- crm perks wp insightly for contact form 7, wpforms, elementor, formidable and ninja formsWordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.5 - Broken Access Control vulnerability6.5 Medium
- villatheme abandoned cart recovery for woocommerceWordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability9.9 Critical
- jordy meow photo engineWordPress Photo Engine plugin <= 6.4.9 - Arbitrary File Upload vulnerability9.1 Critical
- denishua wpjam basicWordPress WPJAM Basic plugin <= 6.9.2 - Arbitrary File Upload vulnerability9.9 Critical
- vanquish woocommerce support ticket systemWordPress WooCommerce Support Ticket System plugin < 18.5 - Arbitrary File Deletion vulnerability8.6 High
- northern beaches websites wp custom admin interfaceWordPress WP Custom Admin Interface plugin <= 7.42 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- andrew munro / affiliatewp rewardswpWordPress RewardsWP plugin <= 1.0.4 - Privilege Escalation vulnerability9.8 Critical
- bit apps smtpWordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability9.0 Critical
- imithemes gaeaWordPress Gaea theme < 3.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- kleor contact managerWordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- kamleshyadav miraculous core pluginWordPress Miraculous Core Plugin plugin < 2.1.2 - SQL Injection vulnerability8.5 High
- kamleshyadav miraculousWordPress Miraculous theme < 2.1.2 - Broken Access Control vulnerability7.5 High
- anton voytenko petitionerWordPress Petitioner plugin <= 0.7.3 - Broken Access Control vulnerability6.5 Medium
- miguel useche js archive listWordPress JS Archive List plugin <= 6.1.7 - PHP Object Injection vulnerability8.8 High
- edge-themes peliculaWordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability9.8 Critical
- mikado-themes stålWordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability5.4 Medium
- edge-themes kamperenWordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability5.4 Medium
- edge-themes graceyWordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerability5.4 Medium
- mikado-themes halsteinWordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerability5.4 Medium
- elated-themes lerouxWordPress Leroux theme < 1.4 - Arbitrary Object Instantiation vulnerability5.4 Medium
- edge-themes archiconWordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerability5.4 Medium
- creativews kiddyWordPress Kiddy theme <= 2.0.8 - Local File Inclusion vulnerability8.1 High
- creativews vintwoodWordPress VintWood theme <= 1.1.8 - Local File Inclusion vulnerability8.1 High
- creativews trendustryWordPress Trendustry theme <= 1.1.4 - Local File Inclusion vulnerability8.1 High
- select-themes borgholmWordPress Borgholm theme < 1.6 - PHP Object Injection vulnerability9.8 Critical
- wp-configurator wp configurator proWordPress WP Configurator Pro plugin <= 3.7.9 - Broken Access Control vulnerability7.1 High
- creativews metamaxWordPress MetaMax theme <= 1.1.4 - Local File Inclusion vulnerability8.1 High
- quantumcloud chatbotWordPress ChatBot plugin <= 7.7.9 - SQL Injection vulnerability9.3 Critical
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability7.5 High
- pickplugins user verificationWordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerability5.3 Medium
- nysl spam protect for contact form 7WordPress Spam Protect for Contact Form 7 plugin <= 1.2.9 - Arbitrary File Deletion vulnerability6.8 Medium
- Show moreLoading…