Medium
CVE-2026-12936
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-14500
Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter
Medium
CVE-2026-57385
Vitepos – Point of Sale (POS) for WooCommerce <= 3.4.2 - Authenticated (Cashier+) SQL Injection
Critical
CVE-2026-14345
WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
Critical
CVE-2026-14289
FacturaONE <= 5.36 - Unauthenticated Remote Code Execution
High
CVE-2025-15662
Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Read
Medium
CVE-2026-14203
Smart Manager <= 8.91.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-12493
Clover Payment Gateway by Zaytech for WooCommerce <= 1.3.5 - Unauthenticated Payment Bypass
Critical
CVE-2026-13152
Custom Fields Account Registration For WooCommerce <= 1.3 - Unauthenticated Privilege Escalation
Medium
CVE-2026-13399
Payment Plugins for PayPal WooCommerce <= 2.0.19 - Uanuthenticated Payment Bypass
Critical
CVE-2026-9725
Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-14352
AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter
Medium
CVE-2026-57773
Advanced Shipment Tracking for WooCommerce <= 4.0 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-57753
Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 - Unauthenticated Information Exposure
Medium
CVE-2026-57758
Permalink Manager for WooCommerce <= 1.0.8.3 - Cross-Site Request Forgery
Medium
CVE-2026-11778
CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter
Medium
CVE-2026-57760
Sendcloud Shipping <= 1.0.31 - Missing Authorization
Medium
CVE-2026-10104
Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter
Medium
CVE-2026-13459
JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Critical
CVE-2026-15158
Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter
A critical vulnerability in Blocksy Companion allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution when the premium edition is active with specific extensions.
Medium
CVE-2026-57352
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 - Missing Authorization
High
CVE-2026-57359
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema <= 2.3.10 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57356
MoreConvert Wishlist for WooCommerce <= 1.9.19 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57358
SysBasics Customize My Account for WooCommerce – Live My Account Customizer <= 4.3.9 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.