CVEs

408,171 total · page 1629 of 8,164

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	KEV	Published	Description
CVE-2026-4092	Google Clasp	Hig	0.50	8.8	0.00		Mar 13, 2026	Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.
CVE-2026-4063	WordPress Social Icons Widget & Block by WPZOOM	Med	0.28	4.3	0.00		Mar 13, 2026	The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() method hooked to admin_menu in all versions up to, and including, 4.5.8. This is due to the method performing…
CVE-2026-3999	Pointsharp ID Server	Hig	0.57	8.8	0.00		Mar 13, 2026	A broken access control may allow an authenticated user to perform a horizontal privilege escalation. The vulnerability only impacts specific configurations.
CVE-2026-3986	WordPress Calculated Fields Form	Med	0.42	6.4	0.00		Mar 13, 2026	The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5.0. This is due to insufficient capability checks on the form settings save handler and insufficient input sanitization…
CVE-2026-3910	Google Chrome	Hig	0.69	8.8	0.03	KEV	Mar 13, 2026	Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-3909	Google Chrome	Hig	0.69	8.8	0.02	KEV	Mar 13, 2026	Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVE-2026-3891	WordPress Pix for WooCommerce	Cri	0.60	9.8	0.32		Mar 13, 2026	The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible…
CVE-2026-3873	Avantra Avantra	Hig	0.47	7.2	0.00		Mar 13, 2026	Use of Hard-coded Credentials vulnerability in Avantra allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Avantra: before 25.3.0.
CVE-2026-3045	WordPress Simply Schedule Appointments	Hig	0.49	7.5	0.00		Mar 13, 2026	The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed…
CVE-2026-32746	GNU Inetutils	Cri	0.70	9.8	0.45		Mar 13, 2026	telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
CVE-2026-32745	Jetbrains Datalore	Med	0.41	6.3	0.00		Mar 13, 2026	In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
CVE-2026-32612	Statamic Statamic	Med	0.28	5.4	0.00		Mar 13, 2026	Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user…
CVE-2026-32598	Oneuptime Oneuptime	Med	0.35	6.5	0.00		Mar 13, 2026	OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to…
CVE-2026-32597	Pyjwt Project Pyjwt	Hig	0.42	7.5	0.00		Mar 13, 2026	PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token…
CVE-2026-32543	Cyberchimps Responsive Blocks	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Blocks: from n/a through <= 2.2.0.
CVE-2026-32487	WordPress Lawyer Landing Page	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Landing Page: from n/a through <= 1.2.7.
CVE-2026-32486	WordPress Travel Booking	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in wptravelengine Travel Booking travel-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Booking: from n/a through <= 1.3.9.
CVE-2026-32462	WordPress Master Addons For Elementor	Med	0.38	5.9	0.00		Mar 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows DOM-Based XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.1.3.
CVE-2026-32461	WordPress Really Simple SSL	Med	0.28	4.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple SSL: from n/a through <= 9.5.7.
CVE-2026-32460	WordPress Ultimate Addons For Contact Form 7	Med	0.42	6.5	0.00		Mar 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…
CVE-2026-32459	WordPress UpsellWP	Hig	0.49	7.6	0.00		Mar 13, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4.
CVE-2026-32458	Realmag777 WOLF bulk-editor	Hig	0.49	7.6	0.00		Mar 13, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through <= 1.0.8.7.
CVE-2026-32457	WordPress Advanced Product Fields for WooCommerce	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce advanced-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Product Fields (Product…
CVE-2026-32456	WordPress Admin Menu Editor	Med	0.28	4.3	0.00		Mar 13, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor admin-menu-editor allows Cross Site Request Forgery.This issue affects Admin Menu Editor: from n/a through <= 1.14.1.
CVE-2026-32455	Realmag777 MDTF wp-meta-data-filter-and-taxonomy-filter	Med	0.42	6.5	0.00		Mar 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows DOM-Based XSS.This issue affects MDTF: from n/a through <= 1.3.5.
CVE-2026-32454	Theme Fusion Avada Core	Med	0.42	6.5	0.00		Mar 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Avada Core fusion-core allows DOM-Based XSS.This issue affects Avada Core: from n/a through < 5.15.0.
CVE-2026-32453	WordPress Avada Core	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through < 5.15.0.
CVE-2026-32452	WordPress Fusion Builder	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.
CVE-2026-32451	WordPress Fusion Builder	Med	0.42	6.5	0.00		Mar 13, 2026	Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.
CVE-2026-32450	WordPress Active Products Tables for WooCommerce	Med	0.42	6.5	0.00		Mar 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for WooCommerce: from n/a…
CVE-2026-32449	WordPress Themify Event Post	Med	0.42	6.5	0.00		Mar 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows Stored XSS.This issue affects Themify Event Post: from n/a through <= 1.3.4.
CVE-2026-32448	WordPress Podlove Podcast Publisher	Med	0.35	6.5	0.00		Mar 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through <= 4.3.3.
CVE-2026-32447	Atarim atarim-visual-collaboration	Med	0.28	4.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.2.
CVE-2026-32446	WordPress WPForms Contact Form	Med	0.28	4.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.9.3.
CVE-2026-32445	WordPress Elementor Website Builder	Low	0.18	2.7	0.00		Mar 13, 2026	Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.35.5.
CVE-2026-32443	WordPress Product Feed PRO for WooCommerce	Med	0.42	6.5	0.00		Mar 13, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Josh Kohlbach Product Feed PRO for WooCommerce woo-product-feed-pro allows Cross Site Request Forgery.This issue affects Product Feed PRO for WooCommerce: from n/a through <= 13.5.2.
CVE-2026-32442	WordPress E2pdf	Med	0.33	5.0	0.00		Mar 13, 2026	Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15.
CVE-2026-32440	WordPress WP Food	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Food: from n/a through < 2.7.1.
CVE-2026-32439	WordPress BigHearts	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in WebGeniusLab BigHearts bighearts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BigHearts: from n/a through <= 3.1.14.
CVE-2026-32438	WordPress Vw School Education	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.
CVE-2026-32437	WordPress VW Portfolio	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.
CVE-2026-32436	WordPress VW Photography	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Photography: from n/a through <= 1.3.8.
CVE-2026-32435	WordPress VW Pet Shop	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Pet Shop: from n/a through <= 1.4.7.
CVE-2026-32434	WordPress VW Fitness	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through <= 4.3.4.
CVE-2026-32433	WordPress Cp Contact Form With Paypal	Hig	0.55	8.5	0.00		Mar 13, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-with-paypal allows Blind SQL Injection.This issue affects CP Contact Form with Paypal: from n/a through <= 1.3.61.
CVE-2026-32432	WordPress Wp Time Slots Booking Form	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.42.
CVE-2026-32431	WordPress Astra Bulk Edit	Med	0.42	6.5	0.00		Mar 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows DOM-Based XSS.This issue affects Astra Bulk Edit: from n/a through <= 1.2.10.
CVE-2026-32430	Ideabox powerpack-lite-for-elementor	Med	0.42	6.5	0.00		Mar 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through <= 2.9.9.
CVE-2026-32429	WordPress Magical Addons For Elementor	Med	0.42	6.5	0.00		Mar 13, 2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.4.1.
CVE-2026-32428	WordPress Popup Likebox	Med	0.34	5.3	0.00		Mar 13, 2026	Missing Authorization vulnerability in Ays Pro Popup Like box ays-facebook-popup-likebox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Like box: from n/a through <= 3.7.7.

CVE-2026-4092HigMar 13, 2026
Google
Clasp
risk 0.50cvss 8.8epss 0.00
Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.
CVE-2026-4063MedMar 13, 2026
WordPress
Social Icons Widget & Block by WPZOOM
risk 0.28cvss 4.3epss 0.00
The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() method hooked to admin_menu in all versions up to, and including, 4.5.8. This is due to the method performing…
CVE-2026-3999HigMar 13, 2026
Pointsharp
ID Server
risk 0.57cvss 8.8epss 0.00
A broken access control may allow an authenticated user to perform a horizontal privilege escalation. The vulnerability only impacts specific configurations.
CVE-2026-3986MedMar 13, 2026
WordPress
Calculated Fields Form
risk 0.42cvss 6.4epss 0.00
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5.0. This is due to insufficient capability checks on the form settings save handler and insufficient input sanitization…
CVE-2026-3910HigKEVMar 13, 2026
Google
Chrome
risk 0.69cvss 8.8epss 0.03
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-3909HigKEVMar 13, 2026
Google
Chrome
risk 0.69cvss 8.8epss 0.02
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVE-2026-3891CriMar 13, 2026
WordPress
Pix for WooCommerce
risk 0.60cvss 9.8epss 0.32
The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible…
CVE-2026-3873HigMar 13, 2026
Avantra
Avantra
risk 0.47cvss 7.2epss 0.00
Use of Hard-coded Credentials vulnerability in Avantra allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Avantra: before 25.3.0.
CVE-2026-3045HigMar 13, 2026
WordPress
Simply Schedule Appointments
risk 0.49cvss 7.5epss 0.00
The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed…
CVE-2026-32746CriMar 13, 2026
GNU
Inetutils
risk 0.70cvss 9.8epss 0.45
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
CVE-2026-32745MedMar 13, 2026
Jetbrains
Datalore
risk 0.41cvss 6.3epss 0.00
In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings
CVE-2026-32612MedMar 13, 2026
Statamic
Statamic
risk 0.28cvss 5.4epss 0.00
Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user…
CVE-2026-32598MedMar 13, 2026
Oneuptime
Oneuptime
risk 0.35cvss 6.5epss 0.00
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to…
CVE-2026-32597HigMar 13, 2026
Pyjwt Project
Pyjwt
risk 0.42cvss 7.5epss 0.00
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token…
CVE-2026-32543MedMar 13, 2026
Cyberchimps
Responsive Blocks
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Blocks: from n/a through <= 2.2.0.
CVE-2026-32487MedMar 13, 2026
WordPress
Lawyer Landing Page
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Landing Page: from n/a through <= 1.2.7.
CVE-2026-32486MedMar 13, 2026
WordPress
Travel Booking
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in wptravelengine Travel Booking travel-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Booking: from n/a through <= 1.3.9.
CVE-2026-32462MedMar 13, 2026
WordPress
Master Addons For Elementor
risk 0.38cvss 5.9epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows DOM-Based XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.1.3.
CVE-2026-32461MedMar 13, 2026
WordPress
Really Simple SSL
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple SSL: from n/a through <= 9.5.7.
CVE-2026-32460MedMar 13, 2026
WordPress
Ultimate Addons For Contact Form 7
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…
CVE-2026-32459HigMar 13, 2026
WordPress
UpsellWP
risk 0.49cvss 7.6epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4.
CVE-2026-32458HigMar 13, 2026
Realmag777
WOLF bulk-editor
risk 0.49cvss 7.6epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through <= 1.0.8.7.
CVE-2026-32457MedMar 13, 2026
WordPress
Advanced Product Fields for WooCommerce
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce advanced-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Product Fields (Product…
CVE-2026-32456MedMar 13, 2026
WordPress
Admin Menu Editor
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor admin-menu-editor allows Cross Site Request Forgery.This issue affects Admin Menu Editor: from n/a through <= 1.14.1.
CVE-2026-32455MedMar 13, 2026
Realmag777
MDTF wp-meta-data-filter-and-taxonomy-filter
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows DOM-Based XSS.This issue affects MDTF: from n/a through <= 1.3.5.
CVE-2026-32454MedMar 13, 2026
Theme Fusion
Avada Core
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Avada Core fusion-core allows DOM-Based XSS.This issue affects Avada Core: from n/a through < 5.15.0.
CVE-2026-32453MedMar 13, 2026
WordPress
Avada Core
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through < 5.15.0.
CVE-2026-32452MedMar 13, 2026
WordPress
Fusion Builder
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.
CVE-2026-32451MedMar 13, 2026
WordPress
Fusion Builder
risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.
CVE-2026-32450MedMar 13, 2026
WordPress
Active Products Tables for WooCommerce
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for WooCommerce: from n/a…
CVE-2026-32449MedMar 13, 2026
WordPress
Themify Event Post
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows Stored XSS.This issue affects Themify Event Post: from n/a through <= 1.3.4.
CVE-2026-32448MedMar 13, 2026
WordPress
Podlove Podcast Publisher
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through <= 4.3.3.
CVE-2026-32447MedMar 13, 2026
Atarim
atarim-visual-collaboration
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.2.
CVE-2026-32446MedMar 13, 2026
WordPress
WPForms Contact Form
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.9.3.
CVE-2026-32445LowMar 13, 2026
WordPress
Elementor Website Builder
risk 0.18cvss 2.7epss 0.00
Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.35.5.
CVE-2026-32443MedMar 13, 2026
WordPress
Product Feed PRO for WooCommerce
risk 0.42cvss 6.5epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Josh Kohlbach Product Feed PRO for WooCommerce woo-product-feed-pro allows Cross Site Request Forgery.This issue affects Product Feed PRO for WooCommerce: from n/a through <= 13.5.2.
CVE-2026-32442MedMar 13, 2026
WordPress
E2pdf
risk 0.33cvss 5.0epss 0.00
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15.
CVE-2026-32440MedMar 13, 2026
WordPress
WP Food
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Food: from n/a through < 2.7.1.
CVE-2026-32439MedMar 13, 2026
WordPress
BigHearts
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in WebGeniusLab BigHearts bighearts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BigHearts: from n/a through <= 3.1.14.
CVE-2026-32438MedMar 13, 2026
WordPress
Vw School Education
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.
CVE-2026-32437MedMar 13, 2026
WordPress
VW Portfolio
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.
CVE-2026-32436MedMar 13, 2026
WordPress
VW Photography
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Photography: from n/a through <= 1.3.8.
CVE-2026-32435MedMar 13, 2026
WordPress
VW Pet Shop
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Pet Shop: from n/a through <= 1.4.7.
CVE-2026-32434MedMar 13, 2026
WordPress
VW Fitness
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through <= 4.3.4.
CVE-2026-32433HigMar 13, 2026
WordPress
Cp Contact Form With Paypal
risk 0.55cvss 8.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-with-paypal allows Blind SQL Injection.This issue affects CP Contact Form with Paypal: from n/a through <= 1.3.61.
CVE-2026-32432MedMar 13, 2026
WordPress
Wp Time Slots Booking Form
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.42.
CVE-2026-32431MedMar 13, 2026
WordPress
Astra Bulk Edit
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows DOM-Based XSS.This issue affects Astra Bulk Edit: from n/a through <= 1.2.10.
CVE-2026-32430MedMar 13, 2026
Ideabox
powerpack-lite-for-elementor
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through <= 2.9.9.
CVE-2026-32429MedMar 13, 2026
WordPress
Magical Addons For Elementor
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.4.1.
CVE-2026-32428MedMar 13, 2026
WordPress
Popup Likebox
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in Ays Pro Popup Like box ays-facebook-popup-likebox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Like box: from n/a through <= 3.7.7.