WordPress plugin vulnerabilities: week 11, 2026
141 vulnerabilities published Mar 9 – Mar 15, 2026 in 123 plugins we track, by day.
3 critical 32 high 105 medium 1 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Friday, March 13, 2026 · 109
-
medium 4.3 WPZOOM Connect
-
medium 6.4 Calculated Fields Form
-
critical 9.8 Pix for WooCommerce
-
high 7.5 Simply Schedule Appointments
-
medium 5.3 Responsive Blocks
-
high 7.6 WOLF
-
high 7.6 UpsellWP
-
medium 5.9 Master Addons for Elementor
-
medium 4.3 Really Simple Security
-
medium 6.5 Ultra Addons for Contact Form 7
-
medium 4.3 Admin Menu Editor
-
medium 6.5 MDTF
-
medium 4.3 Atarim
-
low 2.7 Elementor Website Builder
-
medium 6.5 Podlove Podcast Publisher
-
medium 6.5 Themify Event Post
-
medium 4.3 WPForms
-
medium 5.0 E2Pdf
-
medium 6.5 Product Feed PRO for WooCommerce by AdTribes
-
medium 5.3 WP Food ordering and Restaurant Menu
-
medium 6.5 Astra Bulk Edit
-
high 8.5 CP Contact Form with PayPal
-
medium 6.5 PowerPack Addons for Elementor
-
medium 5.3 WP Time Slots Booking Form
-
medium 5.3 Popup Like box
-
medium 5.4 Admin and Site Enhancements (ASE)
-
medium 5.3 Payment Gateway Pix For GiveWP
-
medium 6.5 Sprout Clients
-
high 8.5 WP EasyCart
-
medium 5.4 GamiPress
-
medium 5.9 List category posts
-
high 7.6 Meow Gallery
-
medium 5.4 Pochipp
-
medium 5.3 Post Timeline
-
high 7.2 Advanced Woo Labels
-
medium 6.5 EMC
-
medium 5.4 PDF Poster
-
medium 5.3 Permalink Manager Lite
-
medium 5.0 Squeeze
-
medium 4.3 Brizy
-
medium 5.3 Forminator Forms
-
medium 5.3 Currency Switcher for WooCommerce by WBW
-
medium 4.3 WPC Product Bundles for WooCommerce
-
medium 4.3 WPC Smart Wishlist for WooCommerce
-
high 7.2 Sprout Invoices
-
medium 5.3 Studio99 WP Monitor
-
medium 6.5 Toocheke Companion
-
high 8.5 Media Library Assistant
-
medium 5.3 Team
-
medium 6.5 Wallet for WooCommerce
Security issue
-
medium 5.3 Xpro Addons For Beaver Builder
-
medium 5.3 YMC Filter
-
medium 4.3 PublishPress Capabilities
-
medium 5.3 Checkout for PayPal
-
medium 5.4 RegistrationMagic
-
medium 4.3 Envo Extra
-
high 8.5 Geo to Lat
-
medium 5.3 ShopBuilder
-
medium 5.4 SMS Alert
-
medium 5.3 WP Sessions Time Monitoring Full Automatic
-
high 8.5 Collapsing Archives
-
high 8.5 Collapsing Categories
-
medium 5.3 WPLifeCycle
-
critical 9.1 Modal Dialog
-
high 7.6 Booking Calendar
-
medium 6.5 Editorial Calendar
-
medium 6.5 Icon List Block
-
medium 6.4 Simple Blog Card
-
medium 5.9 Rich Showcase for Google Reviews
-
medium 6.5 Elementor Website Builder
-
medium 5.3 Event Booking Manager for WooCommerce
-
medium 6.4 MailerPress
-
medium 5.9 PowerPress Podcasting plugin by Blubrry
-
medium 6.5 Robo Gallery
-
medium 4.9 Embed PDF Viewer
-
medium 5.3 MAS Videos
-
medium 4.3 Easy Table of Contents
-
medium 4.3 Quiz Maker by AYS
-
medium 5.3 Advanced Related Posts
-
medium 5.3 Easy Form
-
medium 4.3 Photo Gallery by 10Web
-
medium 5.4 Textmetrics
-
medium 4.3 Advanced Coupons for WooCommerce
-
high 8.5 Fox LMS
-
medium 6.5 immonex Kickstart
-
high 8.5 ERP
-
medium 5.3 Latest Post Shortcode
-
high 7.5 Formidable Forms
-
medium 5.3 Formidable Forms
-
medium 5.4 GetGenie
-
medium 6.4 GetGenie
-
medium 5.3 Comments
Security issue
-
medium 5.4 Comments
-
medium 6.1 Comments
-
medium 5.5 Comments
-
medium 5.3 Comments
Security issue
-
medium 4.9 Comments
-
medium 6.5 Comments
-
medium 5.3 Comments
Security issue
-
high 7.5 Comments
-
medium 5.4 Comments
-
high 7.5 Comments
-
medium 4.3 Simply Schedule Appointments
Thursday, March 12, 2026 · 4
-
medium 6.1 Simple Ajax Chat
-
medium 4.3 Timetics
-
medium 4.3 LearnPress
-
high 7.5 My Sticky Bar
Wednesday, March 11, 2026 · 22
-
high 7.2 Name Directory
-
medium 4.3 WordPress
-
high 8.8 ExactMetrics
-
high 8.8 ExactMetrics
-
high 7.2 Lead Form Builder & Contact Form
-
medium 4.3 Modular DS
-
medium 6.4 HappyAddons for Elementor
-
medium 5.4 HappyAddons for Elementor
-
high 7.5 Simply Schedule Appointments
-
critical 9.8 Datalogics Ecommerce Delivery
-
medium 6.4 weForms
-
high 7.5 WP Maps
-
medium 6.4 WP ULike
-
medium 6.8 Gutena Forms
-
high 8.8 Royal Addons for Elementor
-
high 8.1 ProfilePress
-
medium 6.1 Appointment Booking Plugin
-
medium 6.5 MC4WP
-
medium 6.1 RTMKit for Elementor
Tuesday, March 10, 2026 · 6
-
medium 6.4 NextScripts
-
high 7.2 Unlimited Elements for Elementor
-
high 7.5 The Events Calendar
-
medium 5.3 Booktics
-
medium 5.3 Booktics
-
medium 4.3 Court Reservation
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.