In addition to the regular feature and product patches typically released, there were a few updates of note last month that may be applicable to your site including:
Security-related Patches in March:
WordPress Core received two security patches in March. Both ver 6.9.2 and ver 6.9.4 were considered high priority patches and in each case, the patches were applied to your site within a day of their release.
- WordPress 6.9.2 included 10 security fixes to tackle issues such as cross-site scripting flaws, a file traversal issue in PclZip, an auth bypass on the notes and AJAX query features, plus a regex DoS weakness. Full release notes and details of the issues can be found at the following URL: https://wordpress.org/documentation/wordpress-version/version-6-9-2/
- WordPress 6.9.4 rolled out updated patches for several security fixes that were not fully applied to the 6.9.2 release. Full release notes of the issues can be found here: https://wordpress.org/documentation/wordpress-version/version-6-9-4/
Finally, for those who use it, a Security Patch was released for the e-commerce solution, WooCommerce including 10.5.3. IF exploited, this flaw could allow attackers to create admin accounts and potentially gain full site control through Cross-Site Request Forgery (CSRF). For the vast majority of Care Plan clients running WooCommerce this vulnerability was not an issue because the vulnerability requires a logged-in administrator to visit a malicious link under very specific browser circumstances, which could then trigger unauthorized actions. You can read more about the WooCommerce update and security patch here: https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/
- The Elementor theme once again released multiple security patches. Both 3.35.6 & 3.35.8 patched security flaws.
- Gravity Forms 2.9.29
- Advanced Custom Fields 6.7.1 / 6.7.2 and Secure Custom Fields 6.8.1
- Hustle Pro 7.8.12.1
- Post SMTP 3.9.0
- Gravity SMTP 2.1.5
- Other security patches were applied to The Events Calendar, Feeds for YouTube, Embed Plus for YouTube Gallery, and Widget Options.
All security patches and affected plugins, including some listed in the overview below, are generally installed via your Care Plan within 12-48 hours of an update becoming available depending upon the severity of the patch.
Ongoing Issues, Updates & Improvements:
Reminder for Non-Care Plan Hosting Backups: For those who are NOT utilizing our Care Plan Hosting packages, I’ve migrated away from an older backup plugin to a much newer, modern, backup plugin to better protect your sites. As part of the migration, the frequency of backups for non-Care Plan Hosting sites will be adjusted to match the frequency of changes made to your site. This change is to better manage the amount of cloud storage required for backups which translates to keeping costs of the Care Plan lower for everyone.
Important Note for those who are on a Care Plan hosting package, your site will continue to be backed up on a nightly basis as always.
Divi 5: Elegant Themes has officially released Divi 5 in March 2026. However, Divi 4 will continue to be supported for at least another 6 months at which point migration to Divi 5 will be mandated. In the mean time, third party plugin support continues to roll out. All Care Plan clients will remain on Divi 4 for now while I begin migrating to the final release on selected sites to determine if any compatibility issues arise. Stay tuned for more updates!
Plugin Update Summary for March 2026:
WordPress Core
WordPress 6.9.2 / 6.9.3 / 6.9.4
Security-Related Updates
WordPress 6.9.2 / 6.9.4
Elementor 3.35.6 / 3.35.8
Astra (Elementor Theme) 4.12.4
Ultimate Addons for Elementor 2.8.5
WooCommerce 10.4.4 & 10.5.3
Gravity Forms 2.9.29
Hustle Pro 7.8.12.1
The Events Calendar 6.15.17 / 6.15.17.1
Advanced Custom Fields (ACF) 6.7.1 / 6.7.2
Secure Custom Fields (SCF) 6.8.1
Post SMTP 3.9.0
Gravity SMTP 2.1.5
Feeds for YouTube 2.6.4
Embed Plus for YouTube Gallery 14.2.5
Widget Options 4.2.0
Standard Plugins
Hustle Pro 7.8.11 / 7.8.12 / 7.8.12.1
Gravity Forms 2.9.29
Post SMTP 3.9.0
Gravity SMTP 2.1.4 / 2.1.5
Spellbook 3.0.20
The Events Calendar 6.15.17 / 6.15.17.1
Yoast 27.1.1 / 27.2 / 27.3
JetPack 15.6
Advanced Custom Fields (ACF) 6.7.1 / 6.7.2 / 6.8.0
Secure Custom Fields (SCF) 6.8.1
TablePress 3.2.8
NextGen Gallery 4.1.0 / 4.1.1
Advanced Ads 2.0.18
UpdraftPlus 1.26.2
Slider Revolution 6.7.51
Smart Slider 3 Pro 3.5.1.33
Responsive LightboxGallery 2.7.4 / 2.7.5 / 2.7.6
Widget Options 4.2.0
Google Analytics for WordPress 10.0.3
Constant Contact for WP 2.17.0
Yoast Duplicate Post 4.6
MC4WP 4.12.0
Embed Plus for YouTube Gallery 14.2.5
Feeds for YouTube 2.6.3 / 2.6.4
Themes and Related Plugins
Divi 5.0 Final 5.0 / 5.0.1 / 5.0.2
Divi Booster 5.1 / 5.1.1
Divi Shop Builder 2.0.25
Divi Table Maker 4.0.1
Elementor 3.35.6 / 3.35.7 / 3.35.8 / 3.35.9 / 4.0.0
Astra (Elementor Theme) 4.12.4
Essential Addons for Elementor 6.5.13
Ultimate Addons for Elementor 2.8.5
SeedProd Pro 6.19.9
WooCommerce-Related
WooCommerce 10.6.0 / 10.6.1 / 10.6.2
Woo Smart Coupons 9.73.1 / 9.74.0 / 9.74.1
Woo Product Add-Ons 8.2.0
Flexible Shipping 6.5.8
Flexible Shipping Pro 4.0.14
Woo Shipping 2.2.3 / 2.2.4 / 2.2.5 / 2.2.6
Woo Tax 3.5.1
PDF Inv & Packing List 5.8.0 / 5.8.1 / 5.8.2 / 5.9.0 / 5.9.1 / 5.9.2
Woo Stripe 10.5.0 / 10.5.1 / 10.5.2 / 10.5.3
Woo Square 5.3.0 / 5.3.1
WooPayments 10.6.0
Woo PayPal Payments 3.4.1 / 4.0.1
Google for WooCommerce 3.5.3
Tickera Bridge 1.7.2
Tickera CSV Export 1.3.5
YITH Authorize.net 1.53.0
YITH Dynamic Pricing 4.28.0
YITH Membership 2.29.0
YITH Gift Cards 4.32.0 / 4.32.1 / 4.33.0
YITH AJAX Filter 5.18.0
YITH Product Slider 1.52.0
YITH Category Accordion 2.27.0
YITH Sequential Ord Numb 1.53.0
YITH Anti-Fraud 2.10.0