WordPress plugin vulnerabilities: week 12, 2026
147 vulnerabilities published Mar 16 – Mar 22, 2026 in 140 plugins we track, by day.
2 critical 33 high 110 medium 2 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, March 22, 2026 · 2
-
high 8.8 WP Extended
-
medium 6.4 Yoast SEO
Saturday, March 21, 2026 · 98
-
high 7.5 JetFormBuilder
-
high 8.8 Expire Users
-
medium 4.4 Review Map by RevuKangaroo
-
medium 4.3 Neos Connector for Fakturama
-
medium 6.5 Pre* Party Resource Hints
-
medium 4.3 Speedup Optimization
-
medium 6.4 WP Random Button
-
medium 6.4 Ad Short
-
medium 6.1 Alfie
-
medium 6.4 Ecover Builder For Dummies
-
medium 6.4 fyyd podcast shortcodes
-
medium 6.4 WordPress PayPal Donation
-
medium 6.4 Show Posts list
-
medium 6.5 Task Manager
-
medium 6.4 Text Toggle
-
medium 6.4 WP Games Embed
-
medium 5.3 Build App Online
-
medium 5.3 Punnel
-
medium 5.3 Appmax
Security issue
-
medium 6.4 Paypal Shortcodes
-
medium 6.4 Sheets2Table
-
medium 5.3 Smarter Analytics
-
medium 6.4 Sherk Custom Post Type Displays
-
medium 5.3 e-shot
-
medium 5.3 WP-Chatbot for Messenger
-
high 7.2 Content Syndication Toolkit
-
medium 5.3 REST API TO MiniProgram
-
medium 4.4 Wikilookup
-
medium 4.4 Comment SPAM Wiper
-
medium 5.5 Multi Functional Flexi Lightbox
-
medium 5.3 Canto
-
high 8.8 CMS Commander
-
medium 6.4 MinhNhut Link Gateway
-
medium 4.3 Lobot Slider Administrator
-
medium 4.3 Xhanch
-
high 7.2 Vagaro Booking Widget
-
high 8.8 Linksy Search and Replace
-
medium 6.1 Post Snippits
-
medium 4.4 Ricerca smart and advanced search
-
medium 6.5 HR Press Lite
-
medium 6.5 ElementCamp
-
medium 6.4 Ed's Social Share
-
medium 6.4 Ed's Font Awesome
-
high 7.5 Quentn WP
-
high 7.2 SurveyJS
-
medium 6.1 itsukaita
-
medium 4.4 Reward Video Ad for WordPress
-
medium 6.5 App Builder
-
low 3.8 Post Affiliate Pro
-
medium 6.5 Task Manager
-
medium 4.3 UiPress lite
-
high 7.2 myLinksDump
-
medium 6.1 rexCrawler
-
medium 4.4 Weaver Show Posts
-
medium 6.4 Any Post Slider
-
medium 4.3 Company Posts for LinkedIn
-
medium 6.4 FuseDesk
-
medium 6.4 Integration with Hubspot Forms
-
medium 6.4 Twitter Feeds
-
medium 6.4 Go Night Pro
-
medium 6.4 iVysilani Shortcode
-
medium 6.4 Outgrow
-
medium 6.4 Post Flagger
-
medium 6.4 Simple Football Scoreboard
-
medium 6.1 Comment Genius
-
high 7.5 Fonts Manager
-
high 7.2 Performance Monitor
-
medium 6.4 Tour & Activity Operator Plugin for TourCMS
-
medium 6.4 WP NG Weather
-
medium 4.3 Plugin Name
-
medium 6.4 PQ Addons
-
medium 6.4 Schema Shortcode
-
medium 4.3 SR WP Minify HTML
-
medium 4.3 Group Chat & Video Chat by AtomChat
-
medium 4.4 Mandatory Field
-
high 8.3 MimeTypes Link Icons
-
medium 6.4 Multi Post Carousel by Category
-
medium 4.3 Redirect countdown
-
medium 4.3 WP Posts Re-order
-
high 8.1 Invelity Product Feeds
-
medium 6.4 Logo Slider WP
-
medium 4.4 Survey
-
medium 6.1 WP-WebAuthn
-
high 7.2 WowOptin
-
medium 6.4 Scoreboard for HTML5 Games Lite
-
medium 5.3 RepairBuddy
-
medium 6.4 Contact List
-
medium 4.9 EmailKit
-
high 7.2 Injection Guard
-
medium 4.4 Keep Backup Daily
-
medium 6.4 Image Alt Text Manager
-
low 2.7 Keep Backup Daily
-
medium 6.4 Autoptimize
-
medium 6.4 Autoptimize
Friday, March 20, 2026 · 8
-
critical 9.8 Kali Forms
-
high 7.1 Flash Video Player
-
medium 6.3 affects latest 2.9.1 Photo Contest
-
medium 5.9 Special Box for Content
-
medium 5.3 RockPress
-
medium 4.4 CM Custom Reports
-
medium 6.5 ilGhera Carta Docente for WooCommerce
-
medium 4.3 Membership Plugin
Thursday, March 19, 2026 · 17
-
high 7.5 Simply Schedule Appointments
-
high 7.1 Website LLMs.txt
-
critical 9.1 Mobile App Editor
-
high 7.1 affects latest 1.6.4.1 Table of Contents Creator
-
medium 6.5 WPCasa
-
medium 6.5 Tutor LMS
-
high 8.1 Admin Safety Guard
-
medium 5.3 Instant Popup Builder
-
high 7.5 EventPrime
-
medium 4.3 Add Custom Fields to Media
-
medium 6.4 Info Cards
-
medium 4.3 Download Manager
-
medium 6.4 Draft List
-
medium 6.3 UiPress lite
-
high 7.2 SlimStat Analytics
Wednesday, March 18, 2026 · 12
-
high 7.2 Post SMTP
-
high 8.2 KiviCare
-
high 7.3 KiviCare
-
medium 5.3 Post SMTP
-
medium 6.4 Code Embed
-
medium 5.3 Contextual Related Posts
-
medium 5.4 Yoast Duplicate Post
-
medium 6.1 Writeprint Stylometry
-
medium 6.1 [CR]Paid Link Manager
-
medium 5.3 Subscriptions for WooCommerce
-
medium 6.4 WP Go Maps
Tuesday, March 17, 2026 · 3
-
medium 5.3 Booster for WooCommerce
-
medium 5.3 Royal Addons for Elementor
-
high 7.5 WowStore
Monday, March 16, 2026 · 7
-
medium 5.4 WP Easy Pay
-
high 7.1 Flexmls® IDX Plugin
-
medium 5.3 User Frontend
-
medium 4.3 NEX-Forms
-
high 7.5 NEX-Forms
-
medium 4.3 Wicked Folders
-
medium 5.3 Thim Kit for Elementor
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.