Medium
CVE-2026-13178
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
High
CVE-2026-66439
Advanced AJAX Product Filters <= 3.2.0.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66709
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.42 - Authenticated (Shop Manager+) Remote Code Execution
Critical
CVE-2026-28005
Kadence WooCommerce Email Designer <= 1.5.19 - Unauthenticated Privilege Escalation
Medium
CVE-2026-15211
Subscriptions for WooCommerce <= 2.0.0 - Unauthenticated Payment Verification Bypass
Medium
CVE-2026-15215
Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation
Medium
CVE-2026-18357
WPC Order Tip for WooCommerce <= 3.3.0 - Information Exposure to Unauthenticated Order Data Disclosure
Medium
CVE-2026-18603
Cancel Order & Request Woocommerce <= 1.3.4.33 - Missing Authorization
Medium
CVE-2026-15214
Subscriptions for WooCommerce <= 2.0.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Detail Disclosure
Medium
CVE-2026-16574
Dokan <= 5.0.10 - Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Downloadable Product Access Grant
Medium
CVE-2026-16285
Product Attachment for WooCommerce < 2.3.3 - Unauthenticated Information Exposure
Medium
CVE-2026-16064
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Missing Authorization
High
CVE-2026-16062
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Authenticated (Contributor+) PHP Object Injection
Critical
CVE-2026-8457
WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
Medium
CVE-2025-14073
WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure
Medium
CVE-2026-18059
PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation
Medium
CVE-2026-15662
Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter
High
CVE-2026-15414
Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta
Medium
CVE-2026-14829
Checkimate <= 1.0.13 - Missing Authorization to Unauthenticated License Deactivation
Medium
CVE-2026-66711
WPML Multilingual & Multicurrency for WooCommerce <= 5.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-66707
Meta for WooCommerce <= 3.7.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-18437
MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates
Medium
CVE-2026-16620
WPC Name Your Price for WooCommerce <= 2.2.4 - Unauthenticated Price Manipulation
Medium
CVE-2026-18436
MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.