High
CVE-2026-57704
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-13329
WC Buckaroo BPE Gateway <= 4.8.0 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Order Refund
Medium
CVE-2026-14315
Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels < 2.2.1 - Unauthenticated Conversion Forge
Medium
CVE-2026-10524
CoCart <= 4.8.0 - Unauthenticated Price Manipulation
Medium
CVE-2026-15244
HUSKY - Products Filter Professional for WooCommerce <= 1.4.0 - Authenticated (Shop manager+) Local File Inclusion
Medium
CVE-2026-14309
Chat On Desk <= 1.0.8 - Unauthenticated Two-Factor Authentication Bypass to Password Reset
Medium
CVE-2026-15759
ChatHelp <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes
Medium
CVE-2026-15349
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler
Medium
CVE-2026-11324
WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'
Medium
CVE-2026-61945
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist <= 3.0.6 - Authenticated (Subscriber+) Sensitive Information Exposure
Medium
CVE-2026-57425
Autopay dla WooCommerce <= 2.2.27 - Missing Authorization
High
CVE-2026-15103
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
Medium
CVE-2026-15324
SysBasics Customize My Account for WooCommerce <= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter
Medium
CVE-2026-15306
Product Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter
Medium
CVE-2026-12941
MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter
High
CVE-2026-12753
Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter
Medium
CVE-2026-59522
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.5 - Missing Authorization
Medium
CVE-2026-14831
Easy Booking <= 3.4.0 - Unauthenticated Minimum Booking Bypass
High
CVE-2026-4110
Ultimate Auction Pro <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-15048
GeekyBot <= 1.2.7 - Unauthenticated Information Exposure
High
CVE-2026-4259
Ultimate Auction Pro <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-15258
Product Feed Manager for WooCommerce <= 7.6.0 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-61952
Bulk Edit Products for WooCommerce – WP Sheet Editor <= 1.8.21 - Missing Authorization
Medium
CVE-2026-12103
Wallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.