Medium
CVE-2026-0942
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-0939
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation
Medium
CVE-2025-12895
Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request
Medium
CVE-2026-22334
Woocommerce Book Price <= 1.3 - Authenticated (Subscriber++) Arbitrary File Download
Medium
CVE-2026-27042
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar <= 3.2.1 - Missing Authorization
High
CVE-2025-68041
Omnichannel for WooCommerce <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-25473
WZone <= 14.0.31 - Missing Authorization
Medium
CVE-2026-22335
WooCommerce Frontend Manager – Ultimate < 6.7.7 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-24599
NextMove Lite <= 2.23.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-24999
Alma <= 5.16.1 - Missing Authorization
Medium
CVE-2026-24606
Bayarcash WooCommerce <= 4.3.12 - Missing Authorization
Medium
CVE-2025-15513
Float Payment Gateway <= 1.1.9 - Improper Authorization to Unauthenticated Order Status Manipulation
Medium
CVE-2025-15512
Aplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulation
Medium
CVE-2025-15475
PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2025-14173
Perfit WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion
Critical
CVE-2025-14301
Integration Opvius AI for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary File Deletion/Read via Path Traversal
High
CVE-2025-15266
GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-14880
Netcash WooCommerce Payment Gateway <= 4.1.3 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2026-0678
Shipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter
High
CVE-2025-69004
Bajaar - Highly Customizable WooCommerce WordPress <= 2.1.0 - Unauthenticated Local File Inclusion
Medium
CVE-2025-67620
Anon <= 2.2.10 - Reflected Cross-Site Scripting
High
CVE-2026-27052
Sales Countdown Timer for WooCommerce and WordPress <= 1.1.8.1 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-68908
Barberry <= 2.9.9.87 - Unauthenticated Local File Inclusion
Medium
CVE-2025-14001
WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.