Medium
CVE-2026-82305
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-82215
Payment Gateway PayPay for WooCommerce 0.5 - 0.9.3 - Unauthenticated Payment Bypass
Medium
CVE-2026-78361
zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Missing Authorization
Medium
CVE-2026-18562
HUSKY <= 1.4.3 - Reflected Cross-Site Scripting
Medium
CVE-2026-78172
Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting
Medium
CVE-2026-12215
OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force
Medium
CVE-2026-11496
Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure
Critical
CVE-2026-8778
MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-19840
Notiqoo – Order Notification & Customer Chat for WooCommerce < 1.4.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Modification
Medium
CVE-2026-62136
Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 - Missing Authorization
Medium
CVE-2026-19439
Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Information Exposure
Medium
CVE-2026-27378
Advanced Partial Payment or Deposit for WooCommerce <= 3.1.0 - Missing Authorization
High
CVE-2026-15019
Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment
Critical
CVE-2026-81789
Advanced Product Fields Extended for WooCommerce <= 3.1.6 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-81794
Shirt Product Designer for WooCommerce 1.0.4 - Missing Authorization
Medium
CVE-2026-78536
Robokassa payment gateway for Woocommerce <= 1.8.9 - Missing Authorization
High
CVE-2026-14359
YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user
Medium
CVE-2026-15398
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
Medium
CVE-2026-19778
WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter
Medium
CVE-2026-19802
Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter
High
CVE-2026-76009
Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint
Medium
CVE-2026-8615
ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function
Medium
CVE-2026-84908
WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action
Medium
CVE-2026-11821
Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.