Medium
CVE-2026-24392
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-24625
File Uploads Addon for WooCommerce <= 1.7.3 - Missing Authorization
High
CVE-2025-13457
WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id
Medium
CVE-2025-14948
miniOrange OTP Verification and SMS Notification for WooCommerce <= 4.3.8 - Missing Authorization to Unauthenticated Notification Settings Modification
Medium
CVE-2026-24365
Stock Manager for WooCommerce < 3.6.0 - Cross-Site Request Forgery
Medium
CVE-2026-24366
YITH WooCommerce Request A Quote <= 2.46.0 - Missing Authorization
High
CVE-2025-14657
Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'
Medium
CVE-2025-15019
BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-14886
Japanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification
High
CVE-2025-14436
Brevo for WooCommerce <= 4.0.49 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-0676
Zorka <= 1.5.7 - Missing Authorization
High
CVE-2025-47474
Anarkali <= 1.0.9 - Unauthenticated Local File Inclusion
Medium
CVE-2026-24375
Ultimate Gift Cards for WooCommerce <= 3.2.4 - Missing Authorization
Medium
CVE-2025-14360
Blockons <= 1.2.15 - Missing Authorization
Medium
CVE-2025-22713
WooCommerce Orders & Customers Exporter <= 5.4 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-12550
OchaHouse <= 2.2.8 - Unauthenticated Local File Inclusion
Medium
CVE-2025-69093
ShopMagic <= 4.7.2 - Missing Authorization
Medium
CVE-2025-47444
FiboSearch <= 1.32.1 - Missing Authorization
High
CVE-2025-12549
Rozy - Flower Shop <= 1.2.25 - Unauthenticated Local File Inclusion
Medium
CVE-2025-13974
Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content
Medium
CVE-2025-14626
QR Code for WooCommerce order emails, PDF invoices, packing slips <= 1.9.42 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode Attributes
High
CVE-2025-14070
Reviewify <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary WooCommerce Coupon Creation
Medium
CVE-2025-14460
Piraeus Bank WooCommerce Payment Gateway <= 3.1.4 - Missing Authorization to Unauthenticated Arbitrary Order Status Change
Medium
CVE-2025-13369
Premmerce WooCommerce Customers Manager <= 1.1.14 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.