Medium
CVE-2026-1258
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
High
CVE-2026-1988
Flexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute
High
CVE-2026-0692
BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation
Medium
CVE-2026-32353
MailerPress <= 1.4.2 - Authenticated (Contributor+) Server-Side Request Forgery
High
CVE-2026-1316
Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter
Medium
CVE-2026-39629
Uminex <= 1.0.9 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-39625
TechOne <= 3.0.3 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-69401
WooODT Lite <= 2.5.5 - Unauthenticated Payment Bypass
Medium
CVE-2025-68501
Mollie Payments for WooCommerce <= 8.1.1 - Reflected Cross-Site Scripting
Medium
CVE-2026-39626
Armania <= 1.4.8 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2025-68536
Zota <= 1.3.14 - Unauthenticated Local File Inclusion
Medium
CVE-2025-69393
Exzo <= 1.2.4 - Missing Authorization
High
CVE-2025-68545
Nika <= 1.2.14 - Unauthenticated Local File Inclusion
High
CVE-2025-68543
Diza <= 1.3.15 - Unauthenticated Local File Inclusion
Medium
CVE-2026-22352
Persian Woocommerce SMS <= 7.1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-15400
OpenPix <= 2.13.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Medium
CVE-2026-1748
Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-1826
OpenPOS Lite <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
High
CVE-2026-39613
Boutique <= 2.3.3 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-25343
WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-13391
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion
High
CVE-2025-68552
WooCommerce Coming Soon Product with Countdown <= 5.0 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2026-2268
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
Medium
CVE-2025-14895
PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.