High
CVE-2026-3396
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-1672
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification
Medium
CVE-2026-34898
Event Tickets Manager for WooCommerce <= 1.5.3 - Missing Authorization
High
CVE-2026-34902
Product Table and List Builder for WooCommerce Lite <= 4.6.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-1673
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion
Medium
CVE-2026-34891
IDPay Payment Gateway for Woocommerce <= 2.2.5 - Unauthenticated Information Exposure
Medium
CVE-2026-0626
WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode
High
CVE-2026-4896
WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
Critical
CVE-2025-15484
Order Notification for WooCommerce – Get Audio Alert on new Orders < 3.6.3 - Unauthenticated Remote Code Execution
Medium
CVE-2025-13535
King Addons for Elementor <= 51.1.38 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2026-1710
WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax
Medium
CVE-2026-45213
BEAR <= 1.1.7.1 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-39508
Advanced Coupons for WooCommerce Coupons <= 4.7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-12886
Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_path
Medium
CVE-2026-39477
CartFlows <= 2.2.3 - Missing Authorization
Medium
CVE-2026-39501
FOX <= 1.4.5 - Missing Authorization
Medium
CVE-2026-39571
Instantio <= 3.3.30 - Unauthenticated Information Exposure
Medium
CVE-2026-3138
Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE
Critical
CVE-2026-4001
Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula
Medium
CVE-2026-39497
FOX <= 1.4.5 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-25397
File Uploader for WooCommerce <= 1.0.4 - Unauthenticated Path Traversal
Medium
CVE-2026-25342
Boutique < 2.4.6 - Reflected Cross-Site Scripting
Medium
CVE-2026-23977
Helpdesk Support Ticket System for WooCommerce <= 2.1.2 - Missing Authorization
High
CVE-2026-25031
Tasty Daily < 1.27 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.