Crítica
CVE-2026-16054
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 3.822
Restablecer filtros
Alta
CVE-2026-15397
Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action
Media
CVE-2026-66699
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.10 - Missing Authorization
Media
CVE-2026-14313
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Insecure Direct Object Reference to Unauthenticated Order Receipt Tampering
Media
CVE-2026-14314
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Insecure Direct Object Reference to Unauthenticated Image Attachment Disclosure
Media
CVE-2026-66692
Colissimo shipping methods for WooCommerce <= 2.10.0 - Authenticated (Customer+) Insecure Direct Object Reference
Media
CVE-2026-12584
Payment Gateway for Redsys & WooCommerce Lite <= 7.0.1 - Unauthenticated Payment Bypass
Alta
CVE-2026-14270
Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings
Alta
76fb0ffd-32c1-483d-ae95-9bc70ba1c064
Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
Media
CVE-2026-7436
WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute
Alta
CVE-2026-16597
GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields
Crítica
CVE-2025-10656
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation
Alta
CVE-2026-12144
Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter
Media
CVE-2026-17166
Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action
Media
CVE-2026-17161
WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute
Media
CVE-2026-17162
WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute
Media
CVE-2026-65547
Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Authenticated (Subscriber+) SQL Injection
Media
CVE-2026-15230
YayPricing <= 3.5.6 - Missing Authorization to Authenticated (Subscriber+) Pricing Configuration Modification and Coupon Code Disclosure
Media
CVE-2026-25403
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Missing Authorization
Alta
CVE-2026-13440
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter
Media
CVE-2026-13110
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action
Media
CVE-2026-15411
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action
Media
CVE-2026-15670
SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Media
CVE-2026-15673
SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.