# CVEs published 2026-03-21

162 CVEs were published on March 21, 2026: 1 critical, 35 high. Days are UTC.

- [CVE-2026-4530](https://cve.now/CVE-2026-4530.md): apconw Aix-DB terminology\_retriever.py sql injection (CVSS 4.8, apconw Aix-DB)
- [CVE-2026-4529](https://cve.now/CVE-2026-4529.md): D-Link DHP-1320 SOAP redirect\_count\_down\_page stack-based overflow (CVSS 8.7, D-Link DHP-1320)
- [CVE-2026-3629](https://cve.now/CVE-2026-3629.md): Import and export users and customers \<= 1.29.7 - Privilege Escalation to Administrator via save\_extra\_user\_profile\_fields (CVSS 8.1, carazo Import and export users and customers)
- [CVE-2026-4528](https://cve.now/CVE-2026-4528.md): trueleaf ApiFlow URL Validation http\_proxy.service.ts validateUrlSecurity server-side request forgery (CVSS 6.9, trueleaf ApiFlow)
- [CVE-2026-2756](https://cve.now/CVE-2026-2756.md): OmniPEMF NeoRhythm BLE missing authentication (CVSS 2.3, OmniPEMF NeoRhythm)
- [CVE-2019-25582](https://cve.now/CVE-2019-25582.md): i-doit CMDB 1.12 Arbitrary File Download via file\_manager Parameter (CVSS 7.1, I-Doit doit CMDB)
- [CVE-2019-25581](https://cve.now/CVE-2019-25581.md): i-doit CMDB 1.12 SQL Injection via objGroupID Parameter (CVSS 8.8, I-Doit doit CMDB)
- [CVE-2019-25580](https://cve.now/CVE-2019-25580.md): ownDMS 4.7 SQL Injection via pdfstream.php imagestream.php (CVSS 8.8, ownDMS)
- [CVE-2019-25579](https://cve.now/CVE-2019-25579.md): phpTransformer 2016.9 Directory Traversal via jQueryFileUpload (CVSS 8.7, phpTransformer)
- [CVE-2019-25578](https://cve.now/CVE-2019-25578.md): phpTransformer 2016.9 SQL Injection via GeneratePDF.php (CVSS 8.8, phpTransformer)
- [CVE-2019-25577](https://cve.now/CVE-2019-25577.md): SeoToaster Ecommerce 3.0.0 Local File Inclusion via backend\_theme (CVSS 6.8, SeoToaster Ecommerce)
- [CVE-2019-25576](https://cve.now/CVE-2019-25576.md): Kepler Wallpaper Script 1.1 SQL Injection via category (CVSS 8.8, Keplerwallpapers Kepler Wallpaper Script)
- [CVE-2019-25575](https://cve.now/CVE-2019-25575.md): SimplePress CMS 1.0.7 SQL Injection via p and s Parameters (CVSS 8.8, Sourceforge SimplePress CMS)
- [CVE-2019-25574](https://cve.now/CVE-2019-25574.md): Green CMS 2.x Path Traversal Arbitrary File Download (CVSS 7.1, Greencms Green CMS)
- [CVE-2019-25573](https://cve.now/CVE-2019-25573.md): Green CMS 2.x SQL Injection via cat Parameter (CVSS 7.1, Greencms Green CMS)
- [CVE-2026-4516](https://cve.now/CVE-2026-4516.md): Foundation Agents MetaGPT DataInterpreter write\_analysis\_code.py injection (CVSS 5.3, Foundation Agents MetaGPT)
- [CVE-2019-25572](https://cve.now/CVE-2019-25572.md): NordVPN 6.19.6 Denial of Service via Email Field Buffer Overflow (CVSS 6.9, NordVPN)
- [CVE-2019-25571](https://cve.now/CVE-2019-25571.md): MediaMonkey 4.1.23 Denial of Service via Malformed URL (CVSS 6.9, MediaMonkey)
- [CVE-2019-25570](https://cve.now/CVE-2019-25570.md): RealTerm Serial Terminal 2.0.0.70 Denial of Service via Port Field (CVSS 6.8, RealTerm: Serial Terminal)
- [CVE-2019-25569](https://cve.now/CVE-2019-25569.md): RealTerm Serial Terminal 2.0.0.70 SEH Overflow Crash (CVSS 6.9, RealTerm: Serial Terminal)
- [CVE-2019-25568](https://cve.now/CVE-2019-25568.md): Memu Play 6.0.7 Privilege Escalation via Insecure File Permissions (CVSS 9.3, Memuplay Memu Play)
- [CVE-2019-25567](https://cve.now/CVE-2019-25567.md): Valentina Studio 9.0.5 Linux Buffer Overflow via Host Field (CVSS 6.9, Valentina-Db Valentina Studio)
- [CVE-2019-25566](https://cve.now/CVE-2019-25566.md): TransMac 12.3 Denial of Service via Volume Name Field (CVSS 6.9, Acutesystems TransMac)
- [CVE-2019-25565](https://cve.now/CVE-2019-25565.md): Magic Iso Maker 5.5 Buffer Overflow Denial of Service (CVSS 6.9, Magiciso Magic Iso Maker)
- [CVE-2019-25564](https://cve.now/CVE-2019-25564.md): PCHelpWareV2 1.0.0.5 Denial of Service via Group Field (CVSS 6.8, Uvnc PCHelpWareV2)
- [CVE-2019-25563](https://cve.now/CVE-2019-25563.md): PCHelpWareV2 1.0.0.5 Denial of Service via SC Creation (CVSS 6.9, Uvnc PCHelpWareV2)
- [CVE-2019-25562](https://cve.now/CVE-2019-25562.md): jetAudio 8.1.7 Denial of Service via File Naming Buffer Overflow (CVSS 6.8, Convert Video jetAudio)
- [CVE-2019-25561](https://cve.now/CVE-2019-25561.md): Lyric Maker 2.0.1.0 Denial of Service via Buffer Overflow (CVSS 6.9, Jetaudio Lyric Maker)
- [CVE-2019-25560](https://cve.now/CVE-2019-25560.md): Lyric Video Creator 2.1 Denial of Service via MP3 File (CVSS 8.7, Lyricvideocreator Lyric Video Creator)
- [CVE-2019-25559](https://cve.now/CVE-2019-25559.md): SpotPaltalk 1.1.5 Name/Key Field Denial of Service (CVSS 6.8, Nsauditor SpotPaltalk)
- [CVE-2019-25558](https://cve.now/CVE-2019-25558.md): Selfie Studio 2.17 Denial of Service via Resize Image (CVSS 6.9, Pixarra Selfie Studio)
- [CVE-2019-25557](https://cve.now/CVE-2019-25557.md): TwistedBrush Pro Studio 24.06 Denial of Service via srp File (CVSS 6.9, Pixarra TwistedBrush Pro Studio)
- [CVE-2019-25556](https://cve.now/CVE-2019-25556.md): TwistedBrush Pro Studio 24.06 Resize Image Denial of Service (CVSS 6.9, Pixarra TwistedBrush Pro Studio)
- [CVE-2019-25555](https://cve.now/CVE-2019-25555.md): TwistedBrush Pro Studio 24.06 Script Recorder Denial of Service (CVSS 6.9, Pixarra TwistedBrush Pro Studio)
- [CVE-2019-25554](https://cve.now/CVE-2019-25554.md): Tomabo MP4 Converter 3.25.22 Denial of Service via Name Field (CVSS 6.8, Tomabo MP4 Converter)
- [CVE-2019-25553](https://cve.now/CVE-2019-25553.md): CEWE PHOTO IMPORTER 6.4.3 Denial of Service via Malformed Image (CVSS 6.9, Cewe-Photoworld CEWE PHOTO IMPORTER)
- [CVE-2019-25552](https://cve.now/CVE-2019-25552.md): CEWE PHOTO SHOW 6.4.3 Denial of Service via Password Field (CVSS 8.7, Cewe-Photoworld CEWE PHOTO SHOW)
- [CVE-2019-25551](https://cve.now/CVE-2019-25551.md): Sandboxie 5.30 Denial of Service via Program Alerts Buffer Overflow (CVSS 6.9, Sandboxie)
- [CVE-2019-25550](https://cve.now/CVE-2019-25550.md): Encrypt PDF 2.3 Denial of Service via Buffer Overflow (CVSS 6.9, Verypdf Encrypt PDF)
- [CVE-2019-25549](https://cve.now/CVE-2019-25549.md): VeryPDF PCL Converter 2.7 Denial of Service via PDF Security (CVSS 6.9, VeryPDF PCL Converter)
- [CVE-2019-25548](https://cve.now/CVE-2019-25548.md): BlueStacks 4.80.0.1060 Denial of Service via Search Field (CVSS 6.9, BlueStacks)
- [CVE-2019-25547](https://cve.now/CVE-2019-25547.md): NetAware 1.20 Denial of Service via Add Block Buffer Overflow (CVSS 6.9, Infiltration-Systems NetAware)
- [CVE-2019-25546](https://cve.now/CVE-2019-25546.md): NetAware 1.20 Share Name Denial of Service (CVSS 6.9, Infiltration-Systems NetAware)
- [CVE-2019-25545](https://cve.now/CVE-2019-25545.md): Terminal Services Manager 3.2.1 Local Buffer Overflow Denial of Service (CVSS 6.9, Lizardsystems Terminal Services Manager)
- [CVE-2019-25544](https://cve.now/CVE-2019-25544.md): Pidgin 2.13.0 Denial of Service via Malformed Username (CVSS 6.9, Pidgin)
- [CVE-2026-4515](https://cve.now/CVE-2026-4515.md): Foundation Agents MetaGPT operator.py code\_generate code injection (CVSS 5.3, Foundation Agents MetaGPT)
- [CVE-2026-4514](https://cve.now/CVE-2026-4514.md): PbootCMS Backend UserController.php access control (CVSS 5.3, PbootCMS)
- [CVE-2026-4513](https://cve.now/CVE-2026-4513.md): vanna-ai vanna base.py ask sql injection (CVSS 5.3, vanna-ai vanna)
- [CVE-2026-4511](https://cve.now/CVE-2026-4511.md): vanna-ai vanna legacy exec injection (CVSS 5.3, vanna-ai vanna)
- [CVE-2026-4510](https://cve.now/CVE-2026-4510.md): PbootCMS Parameter MemberController.php alert\_location cross site scripting (CVSS 5.3, PbootCMS)
- [CVE-2026-4373](https://cve.now/CVE-2026-4373.md): JetFormBuilder \<= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field (CVSS 7.5, jetmonsters JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2026-4509](https://cve.now/CVE-2026-4509.md): PbootCMS File Upload file.php incomplete blacklist (CVSS 5.3, PbootCMS)
- [CVE-2026-4022](https://cve.now/CVE-2026-4022.md): Show Posts list \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, creativedev4 Show Posts list – Easy designs, filters and mo…)
- [CVE-2026-3478](https://cve.now/CVE-2026-3478.md): Content Syndication Toolkit \<= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter (CVSS 7.2, benmoody Content Syndication Toolkit)
- [CVE-2026-1914](https://cve.now/CVE-2026-1914.md): FuseDesk \<= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute (CVSS 6.4, jeremyshapiro FuseDesk)
- [CVE-2026-2501](https://cve.now/CVE-2026-2501.md): Ed's Social Share \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, waianaeboy702 Ed's Social Share)
- [CVE-2026-4004](https://cve.now/CVE-2026-4004.md): Task Manager \<= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task\_id' Parameter (CVSS 6.5, eoxia Task Manager)
- [CVE-2026-1278](https://cve.now/CVE-2026-1278.md): Mandatory Field \<= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields (CVSS 4.4, ketanmujumdar Mandatory Field)
- [CVE-2026-2121](https://cve.now/CVE-2026-2121.md): Weaver Show Posts \<= 1.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting (CVSS 4.4, wpweaver Weaver Show Posts)
- [CVE-2026-2837](https://cve.now/CVE-2026-2837.md): Ricerca – advanced search \<= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings (CVSS 4.4, systemsrtk Ricerca – advanced search)
- [CVE-2026-1397](https://cve.now/CVE-2026-1397.md): PQ Addons – Creative Elementor Widgets \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes (CVSS 6.4, peacefulqode PQ Addons – Creative Elementor Widgets)
- [CVE-2026-2723](https://cve.now/CVE-2026-2723.md): Post Snippits \<= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update (CVSS 6.1, phy9pas Post Snippits)
- [CVE-2026-3997](https://cve.now/CVE-2026-3997.md): Text Toggle \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute (CVSS 6.4, hoosierdragon Text Toggle)
- [CVE-2026-3354](https://cve.now/CVE-2026-3354.md): Wikilookup \<= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting (CVSS 4.4, mooeypoo Wikilookup)
- [CVE-2026-4143](https://cve.now/CVE-2026-4143.md): Neos Connector for Fakturama \<= 0.0.14 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, neo2oo5 Neos Connector for Fakturama)
- [CVE-2026-4261](https://cve.now/CVE-2026-4261.md): Expire Users \<= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation to Administrator via save\_extra\_user\_profile\_fields (CVSS 8.8, husobj Expire Users)
- [CVE-2026-4161](https://cve.now/CVE-2026-4161.md): Review Map by RevuKangaroo \<= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (CVSS 4.4, Review Map by RevuKangaroo)
- [CVE-2026-2720](https://cve.now/CVE-2026-2720.md): Hr Press Lite \<= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure (CVSS 6.5, codeclove Hr Press Lite)
- [CVE-2026-3554](https://cve.now/CVE-2026-3554.md): Sherk Custom Post Type Displays \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute (CVSS 6.4, sherkspear Sherk Custom Post Type Displays)
- [CVE-2026-2503](https://cve.now/CVE-2026-2503.md): ElementCamp \<= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta\_query\[compare\]' Parameter (CVSS 6.5, wpdive ElementCamp)
- [CVE-2026-3353](https://cve.now/CVE-2026-3353.md): Comment SPAM Wiper \<= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting (CVSS 4.4, intermod Comment SPAM Wiper)
- [CVE-2026-2351](https://cve.now/CVE-2026-2351.md): Task Manager \<= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Read (CVSS 6.5, eoxia Task Manager)
- [CVE-2026-1911](https://cve.now/CVE-2026-1911.md): Twitter Feeds \<= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'tweet\_title' Shortcode Attribute (CVSS 6.4, viaviwebtech Twitter Feeds)
- [CVE-2026-1648](https://cve.now/CVE-2026-1648.md): Performance Monitor \<= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter (CVSS 7.2, qrolic Performance Monitor)
- [CVE-2026-0609](https://cve.now/CVE-2026-0609.md): Logo Slider \<= 4.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode (CVSS 6.4, logichunt Logo Slider WP – Responsive Logo Carousel, Logo G…)
- [CVE-2026-1575](https://cve.now/CVE-2026-1575.md): Schema Shortcode \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, jeric\_izon Schema Shortcode)
- [CVE-2026-3645](https://cve.now/CVE-2026-3645.md): Punnel \<= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel\_save\_config' AJAX Action (CVSS 5.3, Punnel – Landing Page Builder)
- [CVE-2026-1275](https://cve.now/CVE-2026-1275.md): Multi Post Carousel by Category \<= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute (CVSS 6.4, gbsdeveloper Multi Post Carousel by Category)
- [CVE-2026-1908](https://cve.now/CVE-2026-1908.md): Integration with Hubspot Forms \<= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, minnur Integration with Hubspot Forms)
- [CVE-2026-3617](https://cve.now/CVE-2026-3617.md): Paypal Shortcodes \<= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributes (CVSS 6.4, swergroup Paypal Shortcodes)
- [CVE-2026-1647](https://cve.now/CVE-2026-1647.md): Comment Genius \<= 1.2.5 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, basiliskan Comment Genius)
- [CVE-2026-3347](https://cve.now/CVE-2026-3347.md): Multi Functional Flexi Lightbox \<= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter (CVSS 5.5, arevico Multi Functional Flexi Lightbox)
- [CVE-2026-2427](https://cve.now/CVE-2026-2427.md): itsukaita \<= 0.1.2 - Reflected Cross-Site Scripting via 'day\_from' Parameter (CVSS 6.1, kazunii itsukaita)
- [CVE-2026-4072](https://cve.now/CVE-2026-4072.md): WordPress PayPal Donation \<= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute (CVSS 6.4, tstachl WordPress PayPal Donation)
- [CVE-2026-3546](https://cve.now/CVE-2026-3546.md): e-shot \<= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot\_form\_builder\_get\_account\_data' AJAX Action (CVSS 5.3, forfront e-shot)
- [CVE-2026-3333](https://cve.now/CVE-2026-3333.md): MinhNhut Link Gateway \<= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, MinhNhut Link Gateway)
- [CVE-2025-14037](https://cve.now/CVE-2025-14037.md): Invelity Products Feeds \<= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion (CVSS 8.1, Invelity Product Feeds)
- [CVE-2026-4087](https://cve.now/CVE-2026-4087.md): Pre\* Party Resource Hints \<= 1.8.20 - Authenticated (Subscriber+) SQL Injection via 'hint\_ids' Parameter (CVSS 6.5, samperrow Pre\* Party Resource Hints)
- [CVE-2026-1503](https://cve.now/CVE-2026-1503.md): login\_register \<= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 4.3, frankkoenen Plugin Name: login\_register)
- [CVE-2024-13785](https://cve.now/CVE-2024-13785.md): Contact Form, Survey, Quiz & Popup Form Builder – ARForms \<= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution (CVSS 5.6, reputeinfosystems Contact Form, Survey, Quiz & Popup Form B…)
- [CVE-2026-3619](https://cve.now/CVE-2026-3619.md): Sheets2Table \<= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute (CVSS 6.4, tonyh-1 Sheets2Table)
- [CVE-2026-3331](https://cve.now/CVE-2026-3331.md): Lobot Slider Administrator \<= 0.6.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, chuckmo Lobot Slider Administrator)
- [CVE-2026-1313](https://cve.now/CVE-2026-1313.md): MimeTypes Link Icons \<= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content (CVSS 8.3, eagerterrier MimeTypes Link Icons)
- [CVE-2026-3003](https://cve.now/CVE-2026-3003.md): Vagaro Booking Widget \<= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro\_code' (CVSS 7.2, Vagaro Booking Widget)
- [CVE-2026-1392](https://cve.now/CVE-2026-1392.md): SR WP Minify HTML \<= 2.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, superrishi SR WP Minify HTML)
- [CVE-2026-3460](https://cve.now/CVE-2026-3460.md): REST API TO MiniProgram \<= 5.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter (CVSS 5.3, xjb REST API TO MiniProgram)
- [CVE-2026-3641](https://cve.now/CVE-2026-3641.md): Appmax \<= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint (CVSS 5.3, appmaxplataforma Appmax)
- [CVE-2026-3996](https://cve.now/CVE-2026-3996.md): WP Games Embed \<= 0.1beta - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, sammyb WP Games Embed)
- [CVE-2026-3332](https://cve.now/CVE-2026-3332.md): Xhanch - My Advanced Settings \<= 1.1.2 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, xhanch\_studio Xhanch – My Advanced Settings)
- [CVE-2026-2468](https://cve.now/CVE-2026-2468.md): Quentn WP \<= 1.2.12 - Unauthenticated SQL Injection via 'qntn\_wp\_access' Cookie (CVSS 7.5, Quentn WP)
- [CVE-2026-2294](https://cve.now/CVE-2026-2294.md): UiPress lite | Effortless custom dashboards, admin themes and pages \<= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update (CVSS 4.3, admintwentytwenty UiPress lite | Effortless custom dashboar…)
- [CVE-2026-1253](https://cve.now/CVE-2026-1253.md): Group Chat & Video Chat by AtomChat \<= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update (CVSS 4.3, Group Chat & Video Chat by AtomChat)
- [CVE-2026-1899](https://cve.now/CVE-2026-1899.md): Any Post Slider \<= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post\_type' Shortcode Attribute (CVSS 6.4, itpathsolutions Any Post Slider)
- [CVE-2026-3651](https://cve.now/CVE-2026-3651.md): Build App Online \<= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action (CVSS 5.3, hakeemnala Build App Online)
- [CVE-2026-1806](https://cve.now/CVE-2026-1806.md): Tour & Activity Operator Plugin for TourCMS \<= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, Tour & Activity Operator Plugin for TourCMS)
- [CVE-2026-1247](https://cve.now/CVE-2026-1247.md): Survey \<= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (CVSS 4.4, seosbg Survey)
- [CVE-2026-1935](https://cve.now/CVE-2026-1935.md): Company Posts for LinkedIn \<= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Deletion (CVSS 4.3, brainstation23 Company Posts for LinkedIn)
- [CVE-2026-1886](https://cve.now/CVE-2026-1886.md): Go Night Pro | WordPress Dark Mode Plugin \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute (CVSS 6.4, hrs2015 Go Night Pro | WordPress Dark Mode Plugin)
- [CVE-2026-1891](https://cve.now/CVE-2026-1891.md): Simple Football Scoreboard \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, dogrow Simple Football Scoreboard)
- [CVE-2025-13910](https://cve.now/CVE-2025-13910.md): WP-WebAuthn \<= 1.3.4 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1, axton WP-WebAuthn)
- [CVE-2026-4069](https://cve.now/CVE-2026-4069.md): Alfie – Feed Plugin \<= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter (CVSS 6.1, pftool Alfie – Feed Plugin)
- [CVE-2026-2496](https://cve.now/CVE-2026-2496.md): Ed's Font Awesome \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, waianaeboy702 Ed's Font Awesome)
- [CVE-2026-2424](https://cve.now/CVE-2026-2424.md): Reward Video Ad for WordPress \<= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings (CVSS 4.4, applixir Reward Video Ad for WordPress)
- [CVE-2026-4084](https://cve.now/CVE-2026-4084.md): fyyd podcast shortcodes \<= 0.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute (CVSS 6.4, cbednarek fyyd podcast shortcodes)
- [CVE-2026-4127](https://cve.now/CVE-2026-4127.md): Speedup Optimization \<= 1.5.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01\_enabled' AJAX Action (CVSS 4.3, charlycharm Speedup Optimization)
- [CVE-2026-1093](https://cve.now/CVE-2026-1093.md): WPFAQBlock– FAQ & Accordion Plugin For Gutenberg \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute (CVSS 6.4, creativewerkdesigns WPFAQBlock– FAQ & Accordion Plugin For…)
- [CVE-2026-2290](https://cve.now/CVE-2026-2290.md): Post Affiliate Pro \<= 1.28.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field (CVSS 3.8, jurajsim Post Affiliate Pro)
- [CVE-2026-3506](https://cve.now/CVE-2026-3506.md): WP-Chatbot for Messenger \<= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration Takeover (CVSS 5.3, larrykim WP-Chatbot for Messenger)
- [CVE-2026-4067](https://cve.now/CVE-2026-4067.md): Ad Short \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attribute (CVSS 6.4, nocaredev Ad Short)
- [CVE-2026-2277](https://cve.now/CVE-2026-2277.md): rexCrawler \<= 1.0.15 - Reflected Cross-Site Scripting via 'url' and 'regex' Parameters (CVSS 6.1, larsdrasmussen rexCrawler)
- [CVE-2026-1889](https://cve.now/CVE-2026-1889.md): Outgrow \<= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute (CVSS 6.4, Outgrow)
- [CVE-2026-1851](https://cve.now/CVE-2026-1851.md): iVysilani Shortcode \<= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute (CVSS 6.4, deckercz iVysilani Shortcode)
- [CVE-2026-4077](https://cve.now/CVE-2026-4077.md): Ecover Builder For Dummies \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, miguelmartinezlopez Ecover Builder For Dummies)
- [CVE-2026-1390](https://cve.now/CVE-2026-1390.md): Redirect countdown \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, haghs Redirect countdown)
- [CVE-2026-1378](https://cve.now/CVE-2026-1378.md): WP Posts Re-order \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, suifengtec WP Posts Re-order)
- [CVE-2026-1393](https://cve.now/CVE-2026-1393.md): Add Google Social Profiles to Knowledge Graph Box \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, omarnas Add Google Social Profiles to Knowledge Graph Box)
- [CVE-2026-1854](https://cve.now/CVE-2026-1854.md): Post Flagger \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute (CVSS 6.4, nosoycesaros Post Flagger)
- [CVE-2026-1822](https://cve.now/CVE-2026-1822.md): WP NG Weather \<= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, tonysamperi WP NG Weather)
- [CVE-2026-2941](https://cve.now/CVE-2026-2941.md): Linksy Search and Replace \<= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via linksy\_search\_and\_replace\_item\_details (CVSS 8.8, plugli Linksy Search and Replace)
- [CVE-2026-4086](https://cve.now/CVE-2026-4086.md): WP Random Button \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute (CVSS 6.4, newbiesup WP Random Button)
- [CVE-2026-2375](https://cve.now/CVE-2026-2375.md): App Builder – Create Native Android & iOS Apps On The Flight \<= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter (CVSS 6.5, appcheap App Builder – Create Native Android & iOS Apps On…)
- [CVE-2026-1800](https://cve.now/CVE-2026-1800.md): Fonts Manager | Custom Fonts \<= 1.2 - Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter (CVSS 7.5, wisdomlogix Fonts Manager | Custom Fonts)
- [CVE-2026-2440](https://cve.now/CVE-2026-2440.md): SurveyJS: Drag & Drop Form Builder \<= 2.5.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, devsoftbaltic SurveyJS: Drag & Drop Form Builder)
- [CVE-2026-3335](https://cve.now/CVE-2026-3335.md): Canto \<= 3.1.1 - Missing Authorization to Unauthenticated File Upload (CVSS 5.3, flightbycanto Canto)
- [CVE-2026-3570](https://cve.now/CVE-2026-3570.md): Smarter Analytics \<= 2.0 - Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter (CVSS 5.3, acumenconsulting Smarter Analytics)
- [CVE-2026-3334](https://cve.now/CVE-2026-3334.md): CMS Commander \<= 2.288 - Authenticated (Custom+) SQL Injection via 'or\_blogname' Parameter (CVSS 8.8, thoefter CMS Commander – Manage Multiple Sites)
- [CVE-2026-2279](https://cve.now/CVE-2026-2279.md): myLinksDump \<= 1.6 - Authenticated (Administrator+) SQL Injection via 'sort\_by' and 'sort\_order' Parameters (CVSS 7.2, silvercover myLinksDump)
- [CVE-2026-4302](https://cve.now/CVE-2026-4302.md): WowOptin: Next-Gen Popup Maker \<= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API (CVSS 7.2, wpxpo WowOptin: Next-Gen Popup Maker – Create Stunning Popu…)
- [CVE-2026-32899](https://cve.now/CVE-2026-32899.md): OpenClaw \< 2026.2.25 - Sender Policy Bypass in Slack Reaction and Pin Event Handlers (CVSS 5.3, OpenClaw)
- [CVE-2026-32898](https://cve.now/CVE-2026-32898.md): OpenClaw \< 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadata (CVSS 5.3, OpenClaw)
- [CVE-2026-32897](https://cve.now/CVE-2026-32897.md): OpenClaw \< 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing Fallback (CVSS 6.3, OpenClaw)
- [CVE-2026-32896](https://cve.now/CVE-2026-32896.md): OpenClaw \< 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin (CVSS 6.3, OpenClaw)
- [CVE-2026-32895](https://cve.now/CVE-2026-32895.md): OpenClaw \< 2026.2.26 - Sender Authorization Bypass in Slack System Event Handlers (CVSS 5.3, OpenClaw)
- [CVE-2026-32067](https://cve.now/CVE-2026-32067.md): OpenClaw \< 2026.2.26 - Cross-Account Authorization Bypass in DM Pairing Store (CVSS 2.0, OpenClaw)
- [CVE-2026-32065](https://cve.now/CVE-2026-32065.md): OpenClaw \< 2026.2.25 - Approval Identity Mismatch in system.run Command Execution (CVSS 5.7, OpenClaw)
- [CVE-2026-32064](https://cve.now/CVE-2026-32064.md): OpenClaw \< 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer (CVSS 8.5, OpenClaw)
- [CVE-2026-32058](https://cve.now/CVE-2026-32058.md): OpenClaw \< 2026.2.26 - Approval Context-Binding Weakness in system.run via host=node (CVSS 2.0, OpenClaw)
- [CVE-2026-32057](https://cve.now/CVE-2026-32057.md): OpenClaw \< 2026.2.25 - Authentication Bypass via Control UI client.id Parameter (CVSS 6.0, OpenClaw)
- [CVE-2026-32056](https://cve.now/CVE-2026-32056.md): OpenClaw \< 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.run (CVSS 7.7, OpenClaw)
- [CVE-2026-32055](https://cve.now/CVE-2026-32055.md): OpenClaw \< 2026.2.26 - Workspace Path Boundary Bypass via Non-existent Symlink (CVSS 7.2, OpenClaw)
- [CVE-2026-32054](https://cve.now/CVE-2026-32054.md): OpenClaw \< 2026.2.25 - Symlink Traversal in Browser Trace/Download Path Handling (CVSS 5.9, OpenClaw)
- [CVE-2026-32053](https://cve.now/CVE-2026-32053.md): OpenClaw \< 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID Normalization (CVSS 6.9, OpenClaw)
- [CVE-2026-32052](https://cve.now/CVE-2026-32052.md): OpenClaw \< 2026.2.24 - Hidden Command Execution via Shell-Wrapper Positional argv Carriers (CVSS 5.8, OpenClaw)
- [CVE-2026-32051](https://cve.now/CVE-2026-32051.md): OpenClaw \< 2026.3.1 - Authorization Bypass in Agent Runs via Owner-Only Tool Access (CVSS 8.7, OpenClaw)
- [CVE-2026-32050](https://cve.now/CVE-2026-32050.md): OpenClaw \< 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check Bypass (CVSS 6.3, OpenClaw)
- [CVE-2026-32049](https://cve.now/CVE-2026-32049.md): OpenClaw \< 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass (CVSS 8.7, OpenClaw)
- [CVE-2026-32048](https://cve.now/CVE-2026-32048.md): OpenClaw \< 2026.3.1 - Sandbox Escape via Cross-Agent sessions\_spawn (CVSS 7.7, OpenClaw)
- [CVE-2026-32046](https://cve.now/CVE-2026-32046.md): OpenClaw \< 2026.2.21 - OS-level Sandbox Bypass via --no-sandbox Flag (CVSS 4.8, OpenClaw)
- [CVE-2026-32045](https://cve.now/CVE-2026-32045.md): OpenClaw \< 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale Auth (CVSS 8.2, OpenClaw)
- [CVE-2026-32044](https://cve.now/CVE-2026-32044.md): OpenClaw \< 2026.3.2 - Tar Archive Safety Bypass in Skills Installation (CVSS 6.7, OpenClaw)
- [CVE-2026-32043](https://cve.now/CVE-2026-32043.md): OpenClaw \< 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd Parameter (CVSS 5.9, OpenClaw)
- [CVE-2026-32042](https://cve.now/CVE-2026-32042.md): OpenClaw \< 2026.2.25 - Privilege Escalation via Unpaired Device Identity in Shared Gateway Authentication (CVSS 8.7, OpenClaw)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-03-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.