Skip to content
OpenAdvisories

Archive

5 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /5 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

102 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-28071

    WordPress pixfort Core plugin <= 3.2.22 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PixFort pixfort Core pixfort-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects pixfort Core: from n/a through <= 3.2.22.

    pixfort pixfort Core
  • Medium 6.4
    CVE-2026-28036

    WordPress Ratatouille theme <= 1.2.6 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in SkatDesign Ratatouille ratatouille allows Server Side Request Forgery.This issue affects Ratatouille: from n/a through <= 1.2.6.

    SkatDesign Ratatouille
  • Medium 6.5
    CVE-2026-28038

    WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.21.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a…

    Brainstorm Force Ultimate Addons for WPBakery Page Builder
  • Medium 5.4
    CVE-2026-27411

    WordPress SiteGuard WP plugin plugin <= 1.7.9 - Captcha Bypass vulnerability

    Guessable CAPTCHA vulnerability in jp-secure SiteGuard WP Plugin siteguard allows Functionality Bypass.This issue affects SiteGuard WP Plugin: from n/a through <= 1.7.9.

    jp-secure SiteGuard WP Plugin
  • Medium 6.5
    CVE-2026-27362

    WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bakery Autoresponder Addon: from n/a through <= 1.0.6.

    kamleshyadav WP Bakery Autoresponder Addon
  • Medium 5.9
    CVE-2026-27344 Public exploit

    WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects inseri core: from n/a through <= 1.0.5.

    inseriswiss inseri core
  • Medium 6.5
    CVE-2026-27354

    WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.This issue affects WooCommerce Coming Soon Product wi…

    WebCodingPlace WooCommerce Coming Soon Product with Countdown Web / CMS
  • Medium 6.5
    CVE-2026-23799

    WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.5.

    Themeum Tutor LMS
  • Medium 6.5
    CVE-2026-23546

    WordPress Classified Listing plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in RadiusTheme Classified Listing classified-listing allows Retrieve Embedded Sensitive Data.This issue affects Classified Listing: from n/a through <= 5.3.4.

    RadiusTheme Classified Listing
  • Medium 6.5
    CVE-2026-22459

    WordPress WordPress CTA plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through <= 2.1.2.

    Blend Media WordPress CTA Web / CMS
  • Medium 6.5
    CVE-2025-69343

    WordPress Theater for WordPress plugin <= 0.19 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored XSS.This issue affects Theater for WordPress: from n/a through <= 0.19.

    Jeroen Schmit Theater for WordPress Web / CMS
  • Medium 5.8
    CVE-2025-68515

    WordPress WP Booking System plugin <= 2.0.19.12 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Roland Murg WP Booking System wp-booking-system allows Retrieve Embedded Sensitive Data.This issue affects WP Booking System: from n/a through <= 2.0.19.12.

    Roland Murg WP Booking System
  • Medium 6.9
    CVE-2026-29052

    HumHub Calendar Module: Stored XSS in Event Types

    The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of …

    HumHub GmbH & Co. KG calendar
  • Medium 4.9
    CVE-2026-30777

    EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who…

    EC-CUBE EC-CUBE 4.2 series EC-CUBE 4.1 series EC-CUBE 4.3 series
  • Medium 4.3
    CVE-2026-27982

    django-allauth has an open redirect vulnerability

    An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL.

    allauth django-allauth django-allauth django-allauth Debian Ubuntu PyPI
  • Medium 4.3
    CVE-2026-3072

    Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification

    The Media Library Assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mla_update_compat_fields_action() function in all versions up to, and including, 3.33. This makes it possible for auth…

    dglingren Media Library Assistant Web / CMS
  • Medium 4.9
    CVE-2026-3523

    Apocalypse Meow <= 22.1.0 - Authenticated (Administrator+) SQL Injection via 'type' Parameter

    The Apocalypse Meow plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 22.1.0. This is due to a flawed logical operator in the type validation check on line 261 of ajax.php — the condition uses `…

    blobfolio Apocalypse Meow Web / CMS
  • Medium 6.4
    CVE-2026-3034

    OoohBoi Steroids for Elementor <= 2.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL Controls

    The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _ob_spacerat_link, _ob_bbad_link, and _ob_teleporter_link URL parameters in all versions up to, and including, 2.1.24. This makes it possible for auth…

    sagarpatel124 OoohBoi Steroids for Elementor Web / CMS
  • Medium 6.5
    CVE-2026-2899

    Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

    The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `deleteFile()` method in the `Uploader` class lacking nonce verification and capability checks. The A…

    techjewel Fluent Forms Pro Add On Pack Web / CMS
  • Medium 6.7
    CVE-2026-26033

    UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Unquoted Search Path or Element (CWE-428) …

    Dell UPS Multi-UPS Management Console (MUMC)
  • Medium 5.8
    CVE-2024-43035 Public exploit

    Fonoster is vulnerable to directory traversal

    Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.…

    fonoster fonoster @fonoster/voice npm
  • Medium 5.4
    CVE-2026-26377

    Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the …