High
CVE-2026-22385
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
High
CVE-2026-22432
Woopy - Multipurpose Store WooCommerce WordPress Shop Theme <= 1.2 - Unauthenticated Local File Inclusion
High
CVE-2026-1929
Advanced Woo Labels <= 2.37 - Authenticated (Contributor+) Remote Code Execution via 'callback' Parameter
High
CVE-2026-27381
Aora - Home & Lifestyle Elementor WooCommerce Theme <= 1.3.15 - Unauthenticated Local File Inclusion
Medium
CVE-2026-27374
WooCommerce Order Details <= 3.1 - Missing Authorization
Medium
CVE-2026-27376
Claue - Clean, Minimal Elementor WooCommerce <= 2.2.7 - Reflected Cross-Site Scripting
Medium
CVE-2026-32410
WBW Currency Switcher for WooCommerce <= 2.2.5 - Missing Authorization
Medium
CVE-2026-32407
WPC Smart Wishlist for WooCommerce <= 5.0.8 - Missing Authorization
Medium
CVE-2026-32406
WPC Product Bundles for WooCommerce <= 8.4.5 - Missing Authorization
Medium
CVE-2026-2385
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay
Medium
CVE-2025-14339
weMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion
Medium
CVE-2026-32398
TeraWallet – For WooCommerce <= 1.5.15 - Authenticated (Customer+) Race Condition
Critical
CVE-2026-27540
Woocommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Arbitrary File Upload
High
CVE-2026-27541
Wholesale Suite <= 2.2.6 - Authenticated (Shop Manager) Privilege Escalation
Critical
CVE-2026-27542
Woocommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation
Medium
CVE-2026-39671
Extra Fees Plugin for WooCommerce <= 4.3.3 - Cross-Site Request Forgery
Medium
CVE-2025-13930
Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
Medium
CVE-2026-1455
Whatsiplus Scheduled Notification for Woocommerce <= 1.0.1 - Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX Action
Medium
CVE-2025-14357
Mega Store Woocommerce <= 6.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change
High
CVE-2025-12975
CTX Feed – WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation
Medium
CVE-2025-12500
Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.1 - Unauthenticated Limited File Upload
Medium
CVE-2025-12375
Printful Integration for WooCommerce <= 2.2.11 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-2386
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'
High
CVE-2026-2232
Product Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.