WordPress plugin vulnerabilities: week 13, 2026
154 vulnerabilities published Mar 23 – Mar 29, 2026 in 140 plugins we track, by day.
21 critical 65 high 68 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, March 29, 2026 · 1
Saturday, March 28, 2026 · 4
-
medium 5.4 Quads Ads Manager for Google AdSense
-
medium 5.3 Page Builder
Security issue
-
medium 6.5 Ninja Forms
-
high 7.5 SureForms
Security issue
Friday, March 27, 2026 · 2
-
high 8.0 Ultimate Member
-
medium 6.5 Smart Slider 3
Thursday, March 26, 2026 · 19
-
high 7.5 JS Help Desk
-
medium 4.9 Complianz GDPR/CCPA Cookie Consent Banner
-
high 7.2 Fluent Booking
-
medium 4.3 Conditional Menus
-
medium 5.3 LeadConnector
Security issue
-
medium 6.8 Shared Files
-
medium 4.3 Elementor Website Builder
-
high 7.2 Blackhole for Bad Bots
-
medium 4.3 Blog2Social
-
medium 5.3 FormLift for Keap (Legacy) Web Forms
-
medium 6.4 Simple Download Counter
-
medium 6.4 BWL Advanced FAQ Manager Lite
-
medium 5.4 ShortPixel Image Optimizer
-
high 7.2 ACF Frontend Admin by DynamiApps
-
medium 6.1 FloristPress for Woo
-
high 8.8 Masteriyo LMS
-
high 8.8 WP Job Portal
Wednesday, March 25, 2026 · 112
-
critical 9.1 Nelio A/B Testing
-
high 7.1 oopspam Anti-Spam
-
medium 5.4 PPWP
-
high 7.5 Membership Plugin
-
high 7.1 Taboola Pixel
-
medium 6.8 YML for Yandex Market
-
medium 6.5 JS Help Desk
-
high 8.5 JS Help Desk
-
medium 6.5 Premmerce Redirect Manager
-
critical 9.3 PublishPress Revisions
-
high 7.5 SMTP Mailer
-
high 7.5 Gallery by Visual Portfolio
-
high 8.8 Creator LMS
-
medium 6.5 Appointment Booking Plugin
-
high 7.1 Lead Form Builder & Contact Form
-
critical 9.9 JetFormBuilder
-
high 7.1 Recarto
-
critical 9.9 WPJAM Basic
-
critical 9.1 Photo Engine (Media Organizer & Lightroom)
-
critical 9.0 Bit SMTP
-
high 7.1 Contact Manager
-
critical 9.8 RewardsWP
-
medium 6.5 WP Custom Admin Interface
-
high 8.8 JS Archive List
-
medium 6.5 Petitioner
-
critical 9.3 WPBot
-
high 7.5 RegistrationMagic
-
medium 5.3 User Verification by PickPlugins
Security issue
-
medium 6.8 Spam Protect for Contact Form 7
-
high 7.5 WP Terms Popup
-
medium 5.3 My Tickets
-
medium 6.5 WP Review Slider
-
medium 6.5 WP TripAdvisor Review Slider
-
medium 6.5 bBlocks
-
high 7.7 Comments Import & Export
-
medium 6.5 Contact Form Email
-
high 8.1 User Registration & Membership
-
high 8.8 weForms
-
high 7.5 User Frontend
-
high 8.2 affects latest 1.2.2 Product Rearrange for WooCommerce
-
critical 9.3 affects latest 1.2.2 Product Rearrange for WooCommerce
-
medium 6.5 WP Courses LMS
-
critical 9.8 Bus Ticket Booking with Seat Reservation
-
high 7.5 Addi
Security issue
-
critical 9.1 WPCafe
-
critical 9.9 affects latest 4.12.0 TotalPoll for Polls and Contests
-
medium 6.5 StoreCustomizer
-
medium 6.5 avalex
-
medium 6.5 CP Multi View Events Calendar
-
medium 6.5 ViaBill
-
high 8.1 Mixtape
-
high 7.1 Remoji
-
medium 6.5 GZSEO
-
critical 9.8 Nexa Blocks
-
medium 6.5 ProfileGrid
-
critical 9.1 Widget Wrangler
-
medium 6.5 Vertex Addons for Elementor
-
high 7.5 File Uploader for WooCommerce
-
high 7.5 WPCargo Track & Trace
-
high 7.1 KiviCare
-
medium 6.5 New User Approve
-
critical 9.9 Woody Code Snippets
-
high 7.1 FAQ Builder AYS
-
medium 6.5 SchemaEngine AI
-
critical 9.9 SimpLy Gallery
Security issue
-
high 7.1 WP REST Cache
-
medium 6.8 Product File Upload for WooCommerce
-
medium 6.5 Five Star Restaurant Reservations
-
high 7.1 RSFirewall!
-
medium 6.5 WPForms
-
critical 9.8 Contest Gallery
-
medium 6.5 KiviCare
-
high 7.5 Team
-
high 8.5 ElementInvader Addons for Elementor
-
high 7.5 LearnPress
-
high 8.5 Post Snippets
-
critical 9.3 Advanced Reporting and Statistics for WooComme…
-
medium 6.5 Activity Log for WordPress
-
medium 6.4 Contest Gallery
-
critical 9.8 EventPrime
-
critical 9.8 Xagio SEO & AEO
-
high 8.1 RegistrationMagic
-
high 7.5 Subscriptions for WooCommerce
-
medium 6.5 User Frontend
-
medium 6.5 WPVulnerability
-
medium 6.5 Booking and Rental Manager for Bike
-
high 8.8 Dokan
-
medium 6.4 Ultimate Post Kit
-
high 7.1 WP Telegram Widget and Join Link
-
high 7.5 Job Postings
-
high 7.1 My auctions allegro
-
medium 6.5 My Album Gallery
-
high 7.5 PitchPrint
-
high 7.2 WebToffee WooCommerce Product Feeds
-
high 7.5 EventPrime
-
medium 5.3 PeproDev Ultimate Invoice
Security issue
-
medium 6.4 Easy Image Gallery
Tuesday, March 24, 2026 · 5
-
critical 9.1 WP DSGVO Tools (GDPR)
-
medium 6.5 Product Filter for WooCommerce by WBW
-
high 8.1 Contest Gallery
-
medium 5.4 User Registration & Membership
-
high 8.8 Jupiter X Core
Monday, March 23, 2026 · 11
-
medium 4.3 LearnPress
-
medium 4.3 Smart Custom Fields
-
high 7.5 WP Job Portal
-
medium 6.5 Quiz and Survey Master (QSM)
-
medium 5.3 King Addons for Elementor
-
medium 6.4 Sina Extension for Elementor
-
medium 5.3 ReviewX
-
medium 5.3 ReviewX
-
high 7.3 ReviewX
-
medium 6.5 ReviewX
-
high 7.5 WP Maps
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.