Skip to content
OpenAdvisories

Archive

25 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /25 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

214 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-32507

    WordPress Leroux theme < 1.4 - Arbitrary Object Instantiation vulnerability

    Deserialization of Untrusted Data vulnerability in Elated-Themes Leroux leroux allows Object Injection.This issue affects Leroux: from n/a through < 1.4.

    Elated-Themes Leroux
  • Medium 5.4
    CVE-2026-32506

    WordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerability

    Deserialization of Untrusted Data vulnerability in Edge-Themes Archicon archicon allows Object Injection.This issue affects Archicon: from n/a through < 1.7.

    Edge-Themes Archicon
  • Medium 6.8
    CVE-2026-32496

    WordPress Spam Protect for Contact Form 7 plugin <= 1.2.9 - Arbitrary File Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NYSL Spam Protect for Contact Form 7 wp-contact-form-7-spam-blocker allows Path Traversal.This issue affects Spam Protect for Contact Form 7: from n/a through <= 1…

    NYSL Spam Protect for Contact Form 7
  • Medium 5.3
    CVE-2026-32497

    WordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerability

    Weak Authentication vulnerability in PickPlugins User Verification user-verification allows Authentication Abuse.This issue affects User Verification: from n/a through <= 2.0.45.

    PickPlugins User Verification
  • Medium 6.5
    CVE-2026-32489

    WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Blocks: from n/a through < 2.0.30.

    bPlugins B Blocks
  • Medium 6.5
    CVE-2026-32490

    WordPress WP TripAdvisor Review Slider plugin <= 14.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP TripAdvisor Review Slider wp-tripadvisor-review-slider allows Stored XSS.This issue affects WP TripAdvisor Review Slider: from n/a through <= 14…

    jgwhite33 WP TripAdvisor Review Slider
  • Medium 6.5
    CVE-2026-32491

    WordPress WP Review Slider plugin <= 13.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP Review Slider wp-facebook-reviews allows Stored XSS.This issue affects WP Review Slider: from n/a through <= 13.9.

    jgwhite33 WP Review Slider
  • Medium 5.3
    CVE-2026-32492

    WordPress My Tickets plugin <= 2.1.1 - Bypass Vulnerability vulnerability

    Authentication Bypass by Spoofing vulnerability in Joe Dolson My Tickets my-tickets allows Identity Spoofing.This issue affects My Tickets: from n/a through <= 2.1.1.

    Joe Dolson My Tickets
  • Medium 6.5
    CVE-2026-32483

    WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerability

    Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.63.

    codepeople Contact Form Email
  • Medium 6.5
    CVE-2026-31914

    WordPress WP Courses LMS plugin <= 3.2.26 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hookandhook WP Courses LMS wp-courses allows DOM-Based XSS.This issue affects WP Courses LMS: from n/a through <= 3.2.26.

    hookandhook WP Courses LMS
  • Medium 6.5
    CVE-2026-27046

    WordPress StoreCustomizer plugin <= 2.6.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kaira StoreCustomizer woocustomizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StoreCustomizer: from n/a through <= 2.6.3.

    Kaira StoreCustomizer
  • Medium 6.3
    CVE-2026-25460

    WordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LiquidThemes Ave Core ave-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ave Core: from n/a through <= 2.9.1.

    LiquidThemes Ave Core
  • Medium 6.5
    CVE-2026-25462

    WordPress avalex plugin <= 3.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in avalex avalex avalex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects avalex: from n/a through <= 3.1.3.

    avalex avalex
  • Medium 6.5
    CVE-2026-25469

    WordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerability

    Missing Authorization vulnerability in ViaBill for WooCommerce ViaBill – WooCommerce viabill-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ViaBill – WooCommerce: from n/a through <= 1.1.53.

    ViaBill for WooCommerce ViaBill – WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-25465

    WordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Stored XSS.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.36.

    codepeople CP Multi View Event Calendar
  • Medium 6.5
    CVE-2026-25454

    WordPress The League theme <= 4.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MVPThemes The League the-league allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The League: from n/a through <= 4.4.1.

    MVP Themes The League
  • Medium 6.5
    CVE-2026-25455

    WordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.6…

    PickPlugins Product Slider for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-25430

    WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Mailchimp a…

    CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
  • Medium 6.5
    CVE-2026-25417

    WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Stored XSS.This issue affects ProfileGrid : from n/a through <= 5.9.8.1.

    Metagauss ProfileGrid
  • Medium 6.5
    CVE-2026-25437

    WordPress GZSEO plugin <= 2.0.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in سید محمدامین هاشمی GZSEO gzseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GZSEO: from n/a through <= 2.0.14.

  • Medium 6.5
    CVE-2026-25398

    WordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vertex Addons for Elementor: from n/a through <= 1.6.4.

    Webilia Vertex Addons for Elementor
  • Medium 6.5
    CVE-2026-25390

    WordPress New User Approve plugin <= 3.2.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.3.

    Saad Iqbal New User Approve
  • Medium 6.5
    CVE-2026-25365

    WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through < 0.2.4.

    Özgür KARALAR Kargo Takip
  • Medium 6.5
    CVE-2026-25355

    WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through < 2.4.3.

    skygroup Sanzo
  • Medium 6.5
    CVE-2026-25344

    WordPress Review Schema plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme Review Schema review-schema allows Retrieve Embedded Sensitive Data.This issue affects Review Schema: from n/a through <= 2.2.6.

    RadiusTheme Review Schema
  • Medium 6.5
    CVE-2026-25339

    WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7.

    Syed Balkhi Contact Form by WPForms
  • Medium 6.8
    CVE-2026-25328

    WordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Product File Upload for WooCommerce products-file-upload-for-woocommerce allows Path Traversal.This issue affects Product File Upload for WooCommerce: …

    add-ons.org Product File Upload for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-25327

    WordPress Five Star Restaurant Reservations plugin <= 2.7.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.9.

    Rustaurius Five Star Restaurant Reservations
  • Medium 6.5
    CVE-2026-25034

    WordPress KiviCare plugin <= 3.6.16 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.16.

    Iqonic Design KiviCare
  • Medium 6.5
    CVE-2026-25009

    WordPress Education Zone theme <= 1.3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Zone: from n/a through <= 1.3.8.

    Rara Theme Education Zone
  • Medium 6.5
    CVE-2026-24987

    WordPress WP System Log plugin <= 1.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in activity-log.com WP System Log winterlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP System Log: from n/a through <= 1.2.7.

    activity-log.com WP System Log
  • Medium 6.4
    CVE-2026-24964

    WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Server Side Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.1.2.1.

    Wasiliy Strecker / ContestGallery developer Contest Gallery
  • Medium 6.5
    CVE-2026-24972

    WordPress Elated Listing plugin <= 1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Elated-Themes Elated Listing eltd-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elated Listing: from n/a through <= 1.4.

    Elated-Themes Elated Listing
  • Medium 6.5
    CVE-2026-24376

    WordPress WPVulnerability plugin <= 4.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Javier Casares WPVulnerability wpvulnerability allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPVulnerability: from n/a through <= 4.2.1.

    Javier Casares WPVulnerability
  • Medium 6.5
    CVE-2026-24364

    WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.5.

    wedevs WP User Frontend
  • Medium 6.4
    CVE-2026-24362

    WordPress Ultimate Post Kit plugin <= 4.0.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bdthemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through <= 4.0.21.

    bdthemes Ultimate Post Kit
  • Medium 6.5
    CVE-2026-24370

    WordPress The Grid plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeOne The Grid allows Stored XSS. This issue affects The Grid: from n/a through 2.8.0.

    ThemeOne The Grid
  • Medium 6.5
    CVE-2026-23972

    WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through…

    MagePeople Team Booking and Rental Manager
  • Medium 6.5
    CVE-2026-22485

    WordPress My Album Gallery plugin <= 1.0.4 - Arbitrary File Deletion vulnerability

    Missing Authorization vulnerability in Ruhul Amin My Album Gallery my-album-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Album Gallery: from n/a through <= 1.0.4.

    Ruhul Amin My Album Gallery
  • Medium 5.4
    CVE-2026-20108

    A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, re…

    Cisco Cisco Catalyst SD-WAN Manager Network devices