Medium
CVE-2025-66136
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
High
CVE-2025-13339
Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
Medium
CVE-2025-13924
Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publication
Medium
CVE-2025-62870
Eupago Gateway For Woocommerce <= 4.7.1 - Missing Authorization
Medium
CVE-2025-67589
WooCommerce PDF Invoices & Packing Slips <= 4.9.1 - Missing Authorization
Medium
CVE-2025-66067
Funnel Builder by FunnelKit <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-24942
WpEvently <= 5.1.1 - Cross-Site Request Forgery
Medium
CVE-2025-13137
Live Sales Notification for Woocommerce – Woomotiv <= 3.6.3 - Reflected Cross-Site Scripting
Medium
CVE-2025-13666
Helloprint <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification
Medium
CVE-2025-12091
Search, Filters & Merchandising for WooCommerce <= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
Medium
CVE-2025-67580
Constant Contact + WooCommerce <= 2.4.1 - Missing Authorization
Medium
CVE-2025-66528
Thank You Page Customizer for WooCommerce <= 1.1.8 - Missing Authorization
Medium
CVE-2025-62995
MultiParcels Shipping For WooCommerce <= 1.30.12 - Missing Authorization
Medium
CVE-2025-66086
SMS Alert Order Notifications <= 3.8.8 - Missing Authorization
Medium
CVE-2025-12130
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion
Medium
CVE-2025-12191
PDF Catalog for WooCommerce <= 1.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-63008
ERP <= 1.16.7 - Missing Authorization
Medium
CVE-2025-63015
WooCommerce Payment Gateway – Paysera <= 3.10.0 - Missing Authorization
Medium
CVE-2025-66083
WpEvently <= 5.0.4 - Missing Authorization
High
CVE-2025-11727
Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-13109
HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'
Medium
CVE-2025-63024
Order Delivery Date for WooCommerce <= 4.3.1 - Missing Authorization
Medium
CVE-2025-12358
ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation
Medium
CVE-2025-13606
Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.