Medium
CVE-2026-14196
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-13169
Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover
Medium
CVE-2026-13175
Eventin <= 4.1.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification
High
CVE-2026-17581
WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine
Medium
CVE-2026-15351
WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter
Medium
CVE-2026-15441
Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter
High
CVE-2026-15002
Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter
Medium
CVE-2026-12128
Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter
Medium
CVE-2026-15045
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.7.10 - Unauthenticated Payment Bypass
Medium
CVE-2026-18391
WooCommerce Subscription < 9.1.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-73383
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.47 - Authenticated (Shop Manager+) Arbitrary File Downloaf
High
CVE-2026-73181
Extra Product Options & Add-Ons for WooCommerce < 7.6 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-19073
Order Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Information Exposure
Medium
CVE-2026-14832
ShopSmart Loyalty for WooCommerce <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure
Medium
CVE-2026-13328
Food Menu – Restaurant Menu & Online Ordering for WooCommerce < 6.0.2 - Missing Authorization
High
CVE-2026-16621
Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-13177
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-28154
Samex - Clean, Minimal Shop WooCommerce WordPress <= 2.5 - Reflected Cross-Site Scripting
Medium
CVE-2026-28173
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.19 - Authenticated (Customer+) Arbitrary Content Deletion
Medium
CVE-2026-16611
Product Feed PRO for WooCommerce <= 13.5.6 - Unauthenticated Information Exposure
Medium
CVE-2026-13168
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-28174
Event SOlution <= 4.1.18 - Authenticated (Customer+) Information Exposure
Medium
CVE-2026-73353
Revolut Gateway for WooCommerce < 4.22.10 - Missing Authorization
High
CVE-2026-15205
Paymob for WooCommerce <= 4.1.8 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.