WordPress plugin vulnerabilities: week 10, 2026

97 vulnerabilities published Mar 2 – Mar 8, 2026 in 92 plugins we track, by day.

7 critical 35 high 55 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, March 7, 2026 · 31

• medium 4.4 LotekMedia Popup Form

  Stored cross-site scripting (XSS)

  CVE-2026-2420 · affected 1.0.6 and older · fix not stated

• medium 6.1 WP RSS Aggregator

  DOM-based cross-site scripting (XSS)

  CVE-2026-2433 · affected 5.0.11 and older · fixed in 5.0.12 *

• medium 6.4 Consensus Embed

  Stored cross-site scripting (XSS)

  CVE-2026-1823 · affected 1.6 and older · fix not stated

• medium 6.4 DA Media GigList

  Stored cross-site scripting (XSS)

  CVE-2026-1805 · affected 1.9.0 and older · fix not stated

• medium 6.4 Infomaniak Connect for OpenID

  Stored cross-site scripting (XSS)

  CVE-2026-1824 · affected 1.0.2 and older · fixed in 1.0.4 *

• medium 6.4 Media Library Alt Text Editor

  Stored cross-site scripting (XSS)

  CVE-2026-1820 · affected 1.0.0 and older · fix not stated

• medium 6.4 Show YouTube video

  Stored cross-site scripting (XSS)

  CVE-2026-1825 · affected 1.1 and older · fix not stated

• medium 6.4 MyQtip

  Stored cross-site scripting (XSS)

  CVE-2026-1574 · affected 2.0.5 and older · fix not stated

• medium 4.3 TrueRanker

  Cross-site request forgery (CSRF)

  CVE-2026-1085 · affected 2.2.9 and older · fixed in 2.3.0 *

• medium 4.3 The Guardian News Feed

  Cross-site request forgery (CSRF)

  CVE-2026-1087 · affected 1.2 and older · fix not stated

• high 7.2 WP App Bar

  Stored cross-site scripting (XSS)

  CVE-2026-1074 · affected 1.5 and older · fix not stated

• medium 4.3 Font Pairing Preview For Landing Pages

  Cross-site request forgery (CSRF)

  CVE-2026-1086 · affected 1.3 and older · fix not stated

• medium 6.4 Wueen

  Stored cross-site scripting (XSS)

  CVE-2026-1569 · affected 0.2.0 and older · fix not stated

• medium 4.4 Carta Online

  Stored cross-site scripting (XSS)

  CVE-2026-1071 · affected 2.13.0 and older · fixed in 2.15.1 *

• medium 4.3 Purchase Button For Affiliate Link

  Cross-site request forgery (CSRF)

  CVE-2026-1073 · affected 1.0.2 and older · fix not stated

• high 7.2 Meta Box

  Arbitrary file deletion

  CVE-2025-14675 · affected 5.11.1 and older · fixed in 5.11.2 *

• high 8.8 Paid Videochat Turnkey Site

  Privilege escalation

  CVE-2025-8899 · affected 7.3.20 and older · fixed in 7.5.17 *

• high 7.2 Easy PHP Settings

  Remote code execution

  CVE-2026-3352 · affected 1.0.4 and older · fixed in 1.0.5 *

• medium 4.8 Stock Ticker

  Stored cross-site scripting (XSS)

  CVE-2026-2722 · affected 3.26.1 and older · fixed in 3.26.2 *

• medium 6.1 CM Custom Reports

  Reflected cross-site scripting (XSS)

  CVE-2026-2431 · affected 1.2.7 and older · fixed in 3.1.1 *

• medium 4.9 Community Events

  SQL injection

  CVE-2026-2429 · affected 1.5.8 and older · fixed in 1.5.9 *

• high 7.5 JS Archive List

  PHP object injection

  CVE-2026-2020 · affected 6.1.7 and older · fixed in 6.2.0 *

• medium 4.8 MailArchiver

  Stored cross-site scripting (XSS)

  CVE-2026-2721 · affected 4.4.0 and older · fixed in 4.5.0 *

• medium 4.3 ProfileGrid

  Cross-site request forgery (CSRF)

  CVE-2026-2494 · affected 5.9.8.2 and older · fixed in 5.9.8.3 *

• medium 4.3 ProfileGrid

  Missing authorization check

  CVE-2026-2488 · affected 5.9.8.1 and older · fixed in 5.9.8.2 *

• medium 6.4 Hammas Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-1902 · affected 1.5.11 and older · fixed in 1.5.12 *

• medium 5.3 MDJM Event Management

  Missing authorization check

  CVE-2026-1650 · affected 1.7.8.1 and older · fixed in 1.7.8.2 *

• high 7.5 ZIP Code Based Content Protection

  SQL injection

  CVE-2025-14353 · affected 1.0.2 and older · fixed in 1.0.3 *

• medium 5.3 Greenshift

  Missing authorization check

  CVE-2026-2371 · affected 12.8.3 and older · fixed in 12.8.4 *

• medium 4.3 HUMN-1 AI Website Scanner & Human Certificatio…

  Missing authorization check

  CVE-2026-1981 · affected 0.0.3 and older · fixed in 0.0.4 *

• medium 4.3 WP Frontend Profile

  Cross-site request forgery (CSRF)

  CVE-2026-1644 · affected 1.3.8 and older · fixed in 1.3.9 *

Friday, March 6, 2026 · 4

• medium 5.9 Preferred Languages

  Cross-site scripting (XSS)

  CVE-2024-35644 · affected 2.2.2 and older · fixed in 2.3.0

• high 7.5 WooCommerce

  Cross-site request forgery (CSRF)

  CVE-2026-3589 · affected 5.4.0 up to (not including) 5.4.4, 5.5.0 up to (not including) 5.4.5, 5.6.0 up to (not including) 5.6.3, 5.7.0 up to (not including) 5.7.3, 5.8.0 up to (not including) 5.8.2, 5.9.0 up to (not including) 5.9.2, 6.0.0 up to (not including) 6.0.2, 6.1.0 up to (not including) 6.1.3, 6.2.0 up to (not including) 6.2.3, 6.3.0 up to (not including) 6.3.2, 6.4.0 up to (not including) 6.4.2, 6.5.0 up to (not including) 6.5.2, 6.6.0 up to (not including) 6.6.2, 6.7.0 up to (not including) 6.7.1, 6.8.0 up to (not including) 6.8.3, 6.9.0 up to (not including) 6.9.5, 7.0.0 up to (not including) 7.0.2, 7.1.0 up to (not including) 7.1.2, 7.2.0 up to (not including) 7.2.4, 7.3.0 up to (not including) 7.3.1, 7.4.0 up to (not including) 7.4.2, 7.5.0 up to (not including) 7.5.2, 7.6.0 up to (not including) 7.6.2, 7.7.0 up to (not including) 7.7.3, 7.8.0 up to (not including) 7.8.4, 7.9.0 up to (not including) 7.9.2, 8.0.0 up to (not including) 8.0.5, 8.1.0 up to (not including) 8.1.4, 8.2.0 up to (not including) 8.2.5, 8.3.0 up to (not including) 8.3.4, 8.4.0 up to (not including) 8.4.3, 8.5.0 up to (not including) 8.5.5, 8.6.0 up to (not including) 8.6.4, 8.7.0 up to (not including) 8.7.3, 8.8.0 up to (not including) 8.8.7, 8.9.0 up to (not including) 8.9.5, 9.0.0 up to (not including) 9.0.4, 9.1.0 up to (not including) 9.1.7, 9.2.0 up to (not including) 9.2.5, 9.3.0 up to (not including) 9.3.6, 9.4.0 up to (not including) 9.4.5, 9.5.0 up to (not including) 9.5.4, 9.6.0 up to (not including) 9.6.4, 9.7.0 up to (not including) 9.7.3, 9.8.0 up to (not including) 9.8.7, 9.9.0 up to (not including) 9.9.7, 10.0.0 up to (not including) 10.0.6, 10.1.0 up to (not including) 10.1.4, 10.2.0 up to (not including) 10.2.4, 10.3.0 up to (not including) 10.3.8, 10.4.0 up to (not including) 10.4.4, 10.5.0 up to (not including) 10.5.3 · fixed in 10.5.3

• medium 6.1 WP All Import

  Reflected cross-site scripting (XSS)

  CVE-2026-2830 · affected 4.0.0 and older · fixed in 4.0.1 *

• medium 5.3 Greenshift

  Information disclosure

  CVE-2026-2589 · affected 12.8.3 and older · fixed in 12.8.4 *

Thursday, March 5, 2026 · 39

• medium 6.4 Greenshift

  Stored cross-site scripting (XSS)

  CVE-2026-2593 · affected 12.8.5 and older · fixed in 12.8.6 *

• high 8.1 Drag and Drop Multiple File Upload for Contact…

  Arbitrary file upload

  CVE-2026-3459 · affected 1.3.9.5 and older · fixed in 1.3.9.6 *

• high 8.8 WowOptin

  Missing authorization check

  CVE-2026-1720 · affected 1.4.24 and older · fix not stated

• critical 9.8 Database for Contact Form 7, WPforms, Elemento…

  PHP object injection

  CVE-2026-2599 · affected 1.4.7 and older · fixed in 1.4.8 *

• medium 6.5 Fast Page & Post Duplicator

  SQL injection

  CVE-2026-2893 · affected 6.3 and older · fix not stated

• high 8.1 Membership Plugin

  Privilege escalation

  CVE-2026-1321 · affected 3.2.20 and older · fixed in 3.2.21 *

• medium 4.3 Media Library Assistant

  Missing authorization check

  CVE-2026-3072 · affected 3.33 and older · fixed in 3.34 *

• high 8.5 Filr

  Arbitrary file upload

  CVE-2026-28133 · affected 1.2.14 and older · fixed in 1.2.15 *

• high 8.2 Royal Addons for Elementor

  Security issue

  CVE-2026-28135 · affected 1.7.1052 and older · fixed in 1.7.1053

• medium 6.5 affects latest 1.3.9 Site Suggest

  Missing authorization check

  CVE-2026-28104 · affected 1.3.9 and older · no fix listed yet

• medium 4.9 affects latest 2.2.0 Directory Listings WordPress plugin

  Path traversal / file read

  CVE-2026-28078 · affected 2.2.0 and older · no fix listed yet

• high 7.1 listify

  Reflected cross-site scripting (XSS)

  CVE-2026-28042 · affected 3.2.5 and older · fix not stated

• high 7.5 wpDataTables

  File inclusion

  CVE-2026-28039 · affected 6.5.0.1 and older · fixed in 6.5.0.2

• critical 9.0 Widget Options

  Remote code execution

  CVE-2026-27984 · affected 4.1.3 and older · fixed in 4.2.0

• medium 5.4 SiteGuard WP Plugin

  Security issue

  CVE-2026-27411 · affected 1.7.9 and older · fixed in 1.7.10

• high 7.2 Wholesale Suite

  Privilege escalation

  CVE-2026-27541 · affected 2.2.6 and older · fixed in 2.2.7

• high 7.5 My Tickets

  Information disclosure

  CVE-2026-27406 · affected 2.1.0 and older · fixed in 2.1.1

• high 8.8 NextScripts

  PHP object injection

  CVE-2026-27379 · affected 4.4.7 and older · fix not stated

• critical 9.0 W3 Total Cache

  Security issue

  CVE-2026-27384 · affected 2.9.1 and older · fixed in 2.9.2

• high 7.5 Floating Chat Widget

  Information disclosure

  CVE-2026-27370 · affected 3.5.1 and older · fixed in 3.5.2

• high 8.5 Tablesome Table

  SQL injection

  CVE-2026-27373 · affected 1.2.3 and older · fixed in 1.2.4

• medium 5.9 Scientific and Interactive Blocks

  Missing authorization check

  CVE-2026-27344 · affected 1.0.5 and older · fixed in 1.0.6 *

• high 7.2 Booking for Appointments and Events Calendar

  Privilege escalation

  CVE-2026-24963 · affected 1.2.38 and older · fixed in 2.0

• critical 9.1 AI Engine

  Arbitrary file upload

  CVE-2026-23802 · affected 3.3.2 and older · fixed in 3.3.3

• medium 6.5 Classified Listing

  Information disclosure

  CVE-2026-23546 · affected 5.3.4 and older · fixed in 5.3.5

• high 7.5 Podlove Web Player

  PHP object injection

  CVE-2026-24385 · affected 5.9.1 and older · fixed in 5.9.2

• high 8.8 PowerPress Podcasting plugin by Blubrry

  PHP object injection

  CVE-2026-23798 · affected 11.15.10 and older · fixed in 11.15.11

• medium 6.5 Tutor LMS

  Missing authorization check

  CVE-2026-23799 · affected 3.9.5 and older · fixed in 3.9.6

• high 7.5 Easy Post Submission

  Missing authorization check

  CVE-2026-22479 · affected 2.4.0 and older · fixed in 2.5.0

• medium 6.5 WP CTA

  Missing authorization check

  CVE-2026-22459 · affected 2.1.2 and older · fixed in 2.1.3

• high 8.6 FormGent

  Path traversal / file read

  CVE-2026-22460 · affected 1.7.0 and older · fixed in 1.8.0 *

• high 8.8 affects latest 1.1 Secudeal Payments for Ecommerce

  PHP object injection

  CVE-2026-22471 · affected 1.1 and older · no fix listed yet

• critical 9.9 Builderall for WordPress

  Remote code execution

  CVE-2026-22390 · affected 3.0.1 and older · fix not stated

• high 7.5 ionCube Tester Plus

  Path traversal / file read

  CVE-2025-69411 · affected 1.3 and older · fixed in 1.4

• medium 6.5 Theater for WordPress

  Stored cross-site scripting (XSS)

  CVE-2025-69343 · affected 0.19 and older · fixed in 0.19.1

• medium 5.8 WP Booking System

  Information disclosure

  CVE-2025-68515 · affected 2.0.19.12 and older · fixed in 2.0.19.13

• medium 4.9 Apocalypse Meow

  SQL injection

  CVE-2026-3523 · affected 22.1.0 and older · fixed in 23.0.0 *

• medium 6.4 OoohBoi Steroids for Elementor

  Stored cross-site scripting (XSS)

  CVE-2026-3034 · affected 2.1.24 and older · fixed in 2.1.25 *

• high 7.2 Fluent Forms

  Stored cross-site scripting (XSS)

  CVE-2026-2365 · affected 6.1.17 and older · fixed in 6.1.18 *

Wednesday, March 4, 2026 · 16

• medium 6.4 My Calendar

  Stored cross-site scripting (XSS)

  CVE-2026-2355 · affected 3.7.3 and older · fixed in 3.7.18 *

• medium 6.5 Seraphinite Accelerator

  Information disclosure

  CVE-2026-3058 · affected 2.28.14 and older · fixed in 2.28.15 *

• medium 4.3 Seraphinite Accelerator

  Missing authorization check

  CVE-2026-3056 · affected 2.28.14 and older · fixed in 2.28.15 *

• medium 6.5 Gutena Forms

  Missing authorization check

  CVE-2026-1674 · affected 1.6.0 and older · fixed in 1.6.1 *

• medium 6.1 All-in-One Video Gallery

  Reflected cross-site scripting (XSS)

  CVE-2026-1706 · affected 4.7.1 and older · fixed in 4.7.5 *

• high 7.5 JS Help Desk

  SQL injection

  CVE-2023-7337 · affected 2.8.2 and older · fixed in 2.8.3 *

• medium 6.4 Envira Gallery

  Stored cross-site scripting (XSS)

  CVE-2026-1236 · affected 1.12.3 and older · fixed in 1.12.4 *

• medium 5.4 Enable Media Replace

  Missing authorization check

  CVE-2026-2732 · affected 4.1.7 and older · fixed in 4.1.8 *

• medium 6.5 WP-Members Membership Plugin

  SQL injection

  CVE-2026-2363 · affected 3.5.5.1 and older · fixed in 3.5.6 *

• high 7.5 Mail Mint

  Information disclosure

  CVE-2026-2025 · affected older than 1.19.5 · fixed in 1.19.5

• medium 4.4 morkva UA Shipping

  Stored cross-site scripting (XSS)

  CVE-2026-2292 · affected 1.7.9 and older · fixed in 1.7.10 *

• medium 4.4 Taskbuilder

  Stored cross-site scripting (XSS)

  CVE-2026-2289 · affected 5.0.3 and older · fixed in 5.0.4 *

• medium 5.3 WPBookit

  Missing authorization check

  CVE-2026-1980 · affected 1.0.8 and older · fixed in 1.0.9 *

• medium 6.5 Email Subscribers & Newsletters by Icegram Exp…

  SQL injection

  CVE-2026-1651 · affected 5.9.16 and older · fixed in 5.9.17 *

• high 7.2 Post Grid Blocks & Templates for News, Magazin…

  Server-side request forgery (SSRF)

  CVE-2026-1273 · affected 5.0.8 and older · fix not stated

• high 7.2 WPBookit

  Stored cross-site scripting (XSS)

  CVE-2026-1945 · affected 1.0.8 and older · fixed in 1.0.9 *

Tuesday, March 3, 2026 · 5

• high 7.2 WP Zendesk for Contact Form 7, WPForms, Elemen…

  Stored cross-site scripting (XSS)

  CVE-2026-2568 · affected 1.1.5 and older · fixed in 1.1.6 *

• critical 9.8 User Registration & Membership

  Privilege escalation

  CVE-2026-1492 · affected 5.1.2 and older · fixed in 5.1.3 *

• critical 9.8 All-in-One Microsoft 365 & Entra ID / Azure AD…

  Authentication bypass

  CVE-2026-2628 · affected 2.2.5 and older · fixed in 2.2.7 *

• high 8.8 Page Builder by SiteOrigin

  File inclusion

  CVE-2026-2448 · affected 2.33.5 and older · fixed in 2.34.0 *

• medium 5.3 AI ChatBot with ChatGPT and Content Generator…

  Missing authorization check

  CVE-2026-1336 · affected 2.7.5 and older · fixed in 2.7.6 *

Monday, March 2, 2026 · 2

• high 7.5 Contest Gallery

  SQL injection

  CVE-2026-3180 · affected 28.1.4 and older · fixed in 28.1.6 *

• high 8.8 Master Addons for Elementor

  Remote code execution

  CVE-2026-3132 · affected 2.1.3 and older · fixed in 2.1.4 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan