Medium
CVE-2026-3355
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
High
CVE-2026-5050
Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation
Medium
CVE-2026-6372
Accept Cryptocurrencies with Plisio <= 2.0.6 - Missing Authorization
Medium
CVE-2026-6370
Mini Ajax Cart for WooCommerce <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-63029
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.7.2 - Authenticated (Store vendor+) SQL Injection
High
CVE-2026-5617
Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie
Medium
CVE-2025-15565
Nexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2026-4109
Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
Medium
CVE-2026-2582
Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-4479
WholeSale Products Dynamic Pricing Management WooCommerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2026-4059
ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute
High
CVE-2026-39494
Product Filter for WooCommerce by WBW <= 3.1.2 - Unauthenticated SQL Injection
Medium
CVE-2026-4664
Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter
Medium
CVE-2026-3574
Experto Dashboard for WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' Setting
High
CVE-2026-39470
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails < 2.1.0 - Authenticated (Shop Manager+) Privilege Escalation
High
CVE-2026-39546
MultiLoca <= 4.2.15 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2026-39582
Hitek < 1.8.3 - Unauthenticated Local File Inclusion
High
CVE-2026-39519
GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.0 - Unauthenticated SQL Injection
Medium
CVE-2026-2838
Whole Enquiry Cart for WooCommerce <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole_success_msg' Parameter
Medium
CVE-2026-3594
Riaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint
Medium
CVE-2026-3311
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar
Medium
CVE-2026-4341
Prime Slider <= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' Parameter
High
CVE-2026-3499
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions
Medium
CVE-2026-39434
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.26 - Authenticated (Shop Manager+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.