Critical
CVE-2026-15014
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-16797
ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter
Medium
CVE-2026-16811
ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Medium
CVE-2026-16993
DHL for WooCommerce <= 4.0.0 - Unauthenticated Shipping Label Disclosure
Medium
CVE-2026-15671
SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter
Medium
CVE-2026-16981
DHL for WooCommerce <= 4.0.0 - Insecure Direct Object Reference to Unauthenticated Shipping Label Download
Medium
CVE-2026-16746
MultiVendorX <= 5.0.10 - Insecure Direct Object Reference to Authenticated (Store Owner+) Cross-Store Commission Data Disclosure
Medium
CVE-2026-66475
Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Medium
CVE-2026-65434
ЮKassa для WooCommerce <= 2.16.1 - Authenticated (Subscriber+) Information Exposure
Critical
CVE-2026-16940
Custom Fields for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-16067
Event Booking Manager for WooCommerce (Pro) <= 5.0.2 - Unauthenticated Price Manipulation
Medium
CVE-2026-66442
YayPricing <= 3.5.6 - Missing Authorization
Medium
CVE-2026-14955
Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter
High
CVE-2026-59553
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces <= 7.6.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-59556
Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-16564
Dokan <= 5.0.8 - Insecure Direct Object Reference to Authenticated (Vendor+) Arbitrary Order Status Modification
Medium
CVE-2026-65557
Abandoned Cart Lite for WooCommerce <= 6.8.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Medium
CVE-2026-16565
Dokan <= 5.0.8 - Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Product Attribute Modification
Medium
CVE-2026-12654
Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret
Medium
CVE-2026-15648
Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
High
CVE-2026-12736
WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
Medium
CVE-2026-59537
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-59532
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.2 - Unauthenticated Price Maniputlation
Medium
CVE-2026-59530
Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.