Medium
CVE-2026-65532
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-59536
CoCart – Headless REST API for WooCommerce <= 4.8.4 - Missing Authorization
Medium
CVE-2026-65536
افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری <= 4.4.5 - Cross-Site Request Forgery
Medium
CVE-2026-16078
WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter
Medium
CVE-2026-15794
Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute
Medium
CVE-2026-15647
Brands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field
Medium
CVE-2026-15646
Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
High
CVE-2026-9713
Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload
High
CVE-2026-7534
SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter
Medium
CVE-2026-65457
ЮKassa для WooCommerce <= 2.16.1 - Missing Authorization
Medium
CVE-2026-65460
افزونه پرداخت امن زرینپال برای ووکامرس (ZarinPal for WooCommerce) <= 5.1.0 - Cross-Site Request Forgery
Medium
CVE-2026-65505
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Unauthenticated Information Exposure
Medium
CVE-2026-65503
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-16063
Event Booking Manager for WooCommerce <= 5.3.6 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-65456
Product Slider, Product Grid, Product Masonry <= 1.13.62 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-65550
Tabs Responsive – With WooCommerce Product Tabs Extension <= 2.5 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Medium
CVE-2026-59547
Payment Gateway for PayPal on WooCommerce <= 9.1.4 - Missing Authorization
Critical
CVE-2026-59540
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.6 - Unauthenticated Privilege Escalation
Medium
CVE-2026-65501
Shiptastic for WooCommerce <= 5.1.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-15787
Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes
Medium
CVE-2026-27399
MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.40 - Missing Authorization
High
CVE-2026-59512
PiWeb Product Enquiry or product catalog for WooCommerce <= 2.2.34.43 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-61958
License Manager for WooCommerce <= 3.0.17 - Authenticated (Customer+) Arbitrary Content Deletion
Medium
CVE-2026-14841
King Addons for Elementor <= 51.1.75 - Reflected XSS via Posts Grid Widget
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.