Medium
CVE-2026-9234
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
High
CVE-2026-8157
Vitepos – Point of Sale (POS) for WooCommerce < 3.4.2 - Authenticated (Outlet Manager+) Privilege Escalation
Medium
CVE-2026-27089
Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution <= 2.1.7 - Missing Authorization
Medium
CVE-2026-48883
WPC Product Bundles for WooCommerce <= 8.5.3 - Missing Authorization
High
CVE-2026-42761
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.9 - Unauthenticated SQL Injection
High
CVE-2026-42757
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Authenticated (Subscriber+) Arbitrary File Deletion
Critical
CVE-2026-42758
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Unauthenticated Privilege Escalation
High
CVE-2026-42748
WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce <= 5.4.1 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2026-42753
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.10 - Missing Authorization
High
CVE-2025-11993
WooCommerce Infinite Scroll and Ajax Pagination <= 1.8 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-9618
PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink
Medium
CVE-2026-9241
FOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter
Medium
CVE-2026-8089
weMail <= 2.1.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-48971
Product Import Export for WooCommerce – Import Export Product CSV Suite <= 2.5.6 - Missing Authorization
Medium
CVE-2026-49059
Meta for WooCommerce <= 3.7.0 - Unauthenticated Open Redirect
Medium
CVE-2026-3173
Meta Field Block <= 1.5.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure
Medium
CVE-2026-6287
ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute
Medium
CVE-2026-45441
Event Booking Manager for WooCommerce <= 5.3.3 - Missing Authorization
Medium
CVE-2026-25444
Appointment Booking Plugin for WooCommerce – WpBookingly | All-in-One Service Manager <= 1.2.9 - Missing Authorization
Medium
CVE-2025-14361
Woocommerce Envato Affiliates <= 1.2.1 - Missing Authorization
Medium
CVE-2026-25426
E-cab Taxi Booking Manager for Woocommerce <= 2.0.1 - Missing Authorization
Medium
CVE-2026-27331
Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution <= 2.1.5 - Missing Authorization
Medium
CVE-2026-39642
Nyla <= 1.7 - Unauthenticated Arbitrary Shortcode Execution
Low
CVE-2026-27346
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More < 5.2.10 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.