High
CVE-2025-28942
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
High
CVE-2024-13558
NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure
Medium
CVE-2024-13920
Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
High
CVE-2024-13921
Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
Low
CVE-2024-13922
Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
High
CVE-2024-13923
Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
High
CVE-2025-1770
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-1766
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update
Medium
CVE-2025-23543
FOMO Pay Chinese Payment Solution <= 2.0.4 - Reflected Cross-Site Scripting
Medium
CVE-2025-22767
GlobalPayments WooCommerce <= 1.13.2 - Reflected Cross-Site Scripting
Medium
CVE-2024-51624
Já-Já Pagamentos for WooCommerce <= 1.3.0 - Reflected Cross-Site Scripting
Medium
CVE-2024-12336
WC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wf-export-all
High
CVE-2025-26890
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.4 - Unauthenticated Local File Inclusion
Critical
CVE-2024-13824
CiyaShop - Multipurpose WooCommerce Theme <= 4.19.0 - Unauthenticated PHP Object Injection
Medium
CVE-2025-26762
WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
Medium
CVE-2025-1508
WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download
Medium
CVE-2025-26929
Accounting for WooCommerce <=1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-1527
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module
Medium
CVE-2024-12589
Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timer
Medium
CVE-2025-28876
Skrill Official <= 1.0.66 - Cross-Site Request Forgery
Medium
CVE-2025-26566
In Stock Mailer for WooCommerce <= 2.1.1 - Reflected Cross-Site Scripting
Critical
CVE-2025-1661
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
Medium
CVE-2024-13774
Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name
Medium
CVE-2025-1287
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.