Medium
CVE-2026-13172
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Critical
CVE-2026-18080
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
Critical
CVE-2026-18431
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
High
CVE-2026-78257
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-78283
Music Player for WooCommerce <= 1.8.9 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-16612
FiboSearch – Ajax Search for WooCommerce < 1.34.1 - Unauthenticated Information Exposure
High
CVE-2026-78260
ePayco plugin for WooCommerce <= 8.4.6 - Unauthenticated SQL Injection
High
CVE-2026-18884
WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters
Medium
CVE-2026-27330
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce <= 0.4.62 - Missing Authorization
Medium
CVE-2026-16569
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce <= 0.4.69 - Missing Authorization to Authenticated (Subscriber+) Stock Update
High
CVE-2026-75971
ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
High
CVE-2026-32554
WooCommerce Product Filter <= 3.1.8 - Unauthenticated SQL Injection
High
CVE-2026-32558
WordPress & WooCommerce Affiliate Program <= 8.9.1 - Unauthenticated Privilege Escalation
Medium
CVE-2026-13176
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-77694
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.19 - Unauthenticated Order Completion
Medium
CVE-2026-16577
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.0.14 - Missing Authorization
Medium
CVE-2026-78258
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Missing Authorization
Medium
CVE-2026-77693
Order Tip for WooCommerce < 1.6.0 - Authenticated (Shop Manager+) Arbitrary File Deletion
Medium
CVE-2026-16575
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.0.14 - Unauthenticated Information Exposure
Critical
CVE-2026-15206
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery < 3.9.8 - Authentication Bypass via Account Takeover
Medium
CVE-2026-15046
LitExtension – Automated Store Migration & Import <= 1.2.6 - Cross-Site Request Forgery
Critical
CVE-2026-28171
WooCommerce File Approval <= 10.7 - Unauthenticated Arbitrary File Deletion
Critical
CVE-2026-32477
ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-18027
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.