Skip to content
OpenAdvisories

Archive

March 2026

Vulnerabilities first published in this month (UTC), newest first.

← February 2026 2026 / March April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

2,574 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-25465

    WordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Stored XSS.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.36.

    codepeople CP Multi View Event Calendar
  • Medium 6.5
    CVE-2026-25454

    WordPress The League theme <= 4.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MVPThemes The League the-league allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The League: from n/a through <= 4.4.1.

    MVP Themes The League
  • Medium 6.5
    CVE-2026-25455

    WordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.6…

    PickPlugins Product Slider for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-25430

    WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Mailchimp a…

    CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
  • Medium 6.5
    CVE-2026-25417

    WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Stored XSS.This issue affects ProfileGrid : from n/a through <= 5.9.8.1.

    Metagauss ProfileGrid
  • Medium 6.5
    CVE-2026-25437

    WordPress GZSEO plugin <= 2.0.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in سید محمدامین هاشمی GZSEO gzseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GZSEO: from n/a through <= 2.0.14.

  • Medium 6.5
    CVE-2026-25398

    WordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vertex Addons for Elementor: from n/a through <= 1.6.4.

    Webilia Vertex Addons for Elementor
  • Medium 6.5
    CVE-2026-25390

    WordPress New User Approve plugin <= 3.2.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.3.

    Saad Iqbal New User Approve
  • Medium 6.5
    CVE-2026-25365

    WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through < 0.2.4.

    Özgür KARALAR Kargo Takip
  • Medium 6.5
    CVE-2026-25355

    WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through < 2.4.3.

    skygroup Sanzo
  • Medium 6.5
    CVE-2026-25344

    WordPress Review Schema plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme Review Schema review-schema allows Retrieve Embedded Sensitive Data.This issue affects Review Schema: from n/a through <= 2.2.6.

    RadiusTheme Review Schema
  • Medium 6.5
    CVE-2026-25339

    WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7.

    Syed Balkhi Contact Form by WPForms
  • Medium 6.8
    CVE-2026-25328

    WordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Product File Upload for WooCommerce products-file-upload-for-woocommerce allows Path Traversal.This issue affects Product File Upload for WooCommerce: …

    add-ons.org Product File Upload for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-25327

    WordPress Five Star Restaurant Reservations plugin <= 2.7.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.9.

    Rustaurius Five Star Restaurant Reservations
  • Medium 6.5
    CVE-2026-25034

    WordPress KiviCare plugin <= 3.6.16 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.16.

    Iqonic Design KiviCare
  • Medium 6.5
    CVE-2026-25009

    WordPress Education Zone theme <= 1.3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Zone: from n/a through <= 1.3.8.

    Rara Theme Education Zone
  • Medium 6.5
    CVE-2026-24987

    WordPress WP System Log plugin <= 1.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in activity-log.com WP System Log winterlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP System Log: from n/a through <= 1.2.7.

    activity-log.com WP System Log
  • Medium 6.4
    CVE-2026-24964

    WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Server Side Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.1.2.1.

    Wasiliy Strecker / ContestGallery developer Contest Gallery
  • Medium 6.5
    CVE-2026-24972

    WordPress Elated Listing plugin <= 1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Elated-Themes Elated Listing eltd-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elated Listing: from n/a through <= 1.4.

    Elated-Themes Elated Listing
  • Medium 6.5
    CVE-2026-24376

    WordPress WPVulnerability plugin <= 4.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Javier Casares WPVulnerability wpvulnerability allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPVulnerability: from n/a through <= 4.2.1.

    Javier Casares WPVulnerability
  • Medium 6.5
    CVE-2026-24364

    WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.5.

    wedevs WP User Frontend
  • Medium 6.4
    CVE-2026-24362

    WordPress Ultimate Post Kit plugin <= 4.0.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bdthemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through <= 4.0.21.

    bdthemes Ultimate Post Kit
  • Medium 6.5
    CVE-2026-24370

    WordPress The Grid plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeOne The Grid allows Stored XSS. This issue affects The Grid: from n/a through 2.8.0.

    ThemeOne The Grid
  • Medium 6.5
    CVE-2026-23972

    WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through…

    MagePeople Team Booking and Rental Manager
  • Medium 6.5
    CVE-2026-22485

    WordPress My Album Gallery plugin <= 1.0.4 - Arbitrary File Deletion vulnerability

    Missing Authorization vulnerability in Ruhul Amin My Album Gallery my-album-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Album Gallery: from n/a through <= 1.0.4.

    Ruhul Amin My Album Gallery
  • Medium 5.4
    CVE-2026-20108

    A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, re…

    Cisco Cisco Catalyst SD-WAN Manager Network devices
  • Medium 4.8
    CVE-2026-20112

    A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Softwar…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 5.3
    CVE-2026-20113

    A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Softwar…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 5.4
    CVE-2026-20114

    A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated,…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.1
    CVE-2026-20115

    A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confid…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.5
    CVE-2026-20083

    A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated,…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.5
    CVE-2026-20110

    A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of s…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.1
    CVE-2026-20104

    A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 4.8
    CVE-2026-3218

    Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.

    Drupal Responsive Favicons drupal/responsive_favicons Packagist
  • Medium 6.1
    CVE-2026-3217

    SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 5.0
    CVE-2026-3216

    Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 5.4
    CVE-2026-3215

    Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.

    Drupal Islandora drupal/islandora Packagist
  • Medium 6.5
    CVE-2026-3214

    CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.

    Drupal CAPTCHA drupal/captcha Packagist
  • Medium 4.7
    CVE-2026-3213

    Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.

    Drupal Anti-Spam by CleanTalk drupal/cleantalk Packagist
  • Medium 5.4
    CVE-2026-3212

    Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.

    Drupal Tagify drupal/tagify Packagist