Medium
CVE-2025-22352
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2024-56272
Hide Category by User Role for WooCommerce <= 2.1.1 - Missing Authorization
Medium
CVE-2024-56065
WP2LEADS <= 3.4.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-22318
Standard Box Sizes – for WooCommerce <= 1.6.13 - Missing Authorization
Medium
CVE-2024-56260
ShopElement <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-24609
PORTONE 우커머스 결제 <= 3.2.5 - Reflected Cross-Site Scripting
Medium
CVE-2025-24597
Barcode Generator for WooCommerce – Show barcodes on products, orders, invoices and other pages <= 2.0.2 - Authenticated (Subscriber+) Sensitive Information Disclosure
Medium
CVE-2024-13865
S3Player – WooCommerce & Elementor Integration <= 4.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2024-12413
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.0.00 - Missing Authorization
Medium
CVE-2024-12032
Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection
Critical
CVE-2024-11281
WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change
Medium
CVE-2025-24565
WP2LEADS <= 3.3.3 - Reflected Cross-Site Scripting
Medium
CVE-2024-11636
Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Block
Medium
CVE-2024-12210
Print Invoice & Delivery Notes for WooCommerce <= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletion
Medium
CVE-2024-12566
Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-12568
Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Workflow Settings
Medium
CVE-2024-12567
Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Form Settings
Medium
CVE-2024-12266
ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization
Medium
CVE-2024-11230
Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget
Medium
CVE-2025-24592
SysBasics Customize My Account for WooCommerce <= 2.8.22 - Reflected Cross-Site Scripting
High
CVE-2024-12721
Custom Product Tabs For WooCommerce <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection
Medium
CVE-2024-11938
One Click Upsell Funnel for WooCommerce <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode
Medium
CVE-2024-11893
Spoki – Chat Buttons and WooCommerce Notifications <= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-56213
Eventin <= 4.0.7 - Authenticated (Contributor+) Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.