Medium
CVE-2026-14342
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-13450
GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter
Medium
CVE-2026-13011
ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter
Medium
CVE-2026-7558
Age Verification & Identity Verification by Token of Trust <= 4.0.2 - Missing Authorization to Unauthenticated Information Exposure via 'tot_export_table' Parameter
Medium
CVE-2026-13771
Customer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
Medium
CVE-2026-57404
Booking and Rental Manager <= 2.6.9 - Missing Authorization
Medium
CVE-2026-57698
Abandoned Cart Recovery for WooCommerce <= 1.1.12 - Missing Authorization
Medium
CVE-2026-13080
WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
Medium
CVE-2026-57424
Razorpay Payment Links for WooCommerce <= 2.1.4 - Missing Authorization
High
CVE-2026-57410
MailerPress – Newsletter, email marketing & AI automation <= 2.0.2 - Authenticated (Contributor+) Privilege Escalation
High
CVE-2026-57417
Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD <= 3.1.57 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57414
AI ChatBot for eCommerce – WoowBot <= 4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-57409
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57412
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.6.9 - Missing Authorization
Medium
CVE-2026-57400
Event Tickets Manager for WooCommerce <= 1.5.5 - Missing Authorization
Medium
CVE-2026-57402
Flexible Refund for WooCommerce – EU One Click Return <= 1.0.51 - Authenticated (Customer+) Stored Cross-Site Scripting
Medium
CVE-2026-11359
Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation
Medium
CVE-2026-57422
Bopo – WooCommerce Product Bundle Builder <= 1.2.0 - Reflected Cross-Site Scripting
Medium
CVE-2026-57393
PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure
Medium
CVE-2026-57390
Extra Product Options Builder for WooCommerce <= 1.2.167 - Missing Authorization
Medium
CVE-2026-57419
Stock Locations for WooCommerce <= 3.1.8 - Missing Authorization
High
CVE-2026-57396
Free Gifts for WooCommerce <= 13.1.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57415
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.7.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-3688
WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.