Medium
CVE-2026-11600
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Critical
CVE-2026-11387
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
High
CVE-2026-7517
Custom Payment Gateways for WooCommerce <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'alg_wc_cpg_input_fields' Parameter
High
CVE-2026-57677
Novalnet Payment Gateway for WooCommerce <= 12.10.3 - Unauthenticated PHP Object Injection
High
CVE-2026-57320
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57679
GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.5 - Unauthenticated SQL Injection
Medium
CVE-2026-57341
Colissimo shipping methods for WooCommerce <= 2.9.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-57332
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.6 - Missing Authorization
Medium
CVE-2026-57329
WooCommerce Designer Pro <= 1.9.34 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-57685
Martfury - WooCommerce Marketplace WordPress <= 3.2.8 - Missing Authorization
Medium
CVE-2026-49779
Tax Exempt for WooCommerce <= 1.9.3 - Authenticated (Customer+) Path Traversal
Medium
CVE-2026-57340
Japanized for WooCommerce <= 2.9.12 - Missing Authorization
Medium
CVE-2026-39448
NOWPayments for WooCommerce – Crypto Payment Gateway <= 1.4.0 - Missing Authorization
Medium
CVE-2026-11364
Product Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX Actions
Medium
CVE-2026-11987
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter
Medium
CVE-2026-11783
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU
Medium
CVE-2026-57637
Abandoned Cart Lite for WooCommerce <= 6.8.0 - Cross-Site Request Forgery
Medium
CVE-2026-3462
Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification
Medium
CVE-2026-57635
FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 - Cross-Site Request Forgery
Medium
CVE-2026-57660
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.1 - Missing Authorization
Medium
CVE-2026-57322
weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce <= 2.1.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-12393
WPS Bookings for WooCommerce <= 3.11.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Order Cancellation
Medium
CVE-2026-57664
Bopo – WooCommerce Product Bundle Builder <= 1.1.6 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-57649
Shoppable Images (Lookbook) for WooCommerce <= 1.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.