Medium
CVE-2025-15609
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-52695
ABC Crypto Checkout <= 1.8.2 - Unauthenticated Information Exposure
Medium
CVE-2026-52700
WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce <= 3.0.2 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-52694
Digital Signature Add-on for WooCommerce <= 2.0 - Unauthenticated Information Exposure
Medium
CVE-2026-52698
PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget <= 4.2.3 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-11568
Product Configurator for WooCommerce <= 1.7.2 - Unauthenticated Private/Draft Product Data Disclosure
Medium
CVE-2026-49068
Coupon Affiliates – Affiliate Plugin for WooCommerce <= 7.8.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-8599
MailerPress <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content Field
High
CVE-2026-9662
Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter
Medium
CVE-2026-8904
FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Save
High
CVE-2026-49061
WPC Product Options for WooCommerce <= 3.2.1 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-49071
WooCommerce Dropshipping Premium <= 5.2.4 - Missing Authorization
Medium
CVE-2026-49065
Hippoo Mobile App for WooCommerce <= 1.9.5 - Missing Authorization
Medium
CVE-2026-49072
WooCommerce Anti-Fraud <= 7.2.6 - Missing Authorization
Critical
CVE-2026-10580
Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API
Critical
CVE-2026-10735
Multiple ShapedPlugin Plugins < (Various Versions) - Backdoored Software
Medium
CVE-2026-49110
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.4 - Missing Authorization
Medium
CVE-2026-9702
InPost PL <= 1.9.0 - Missing Authorization to Unauthenticated WooCommerce Order Parcel-Locker Hijacking
Medium
CVE-2025-10268
Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Directory Traversal to Unauthenticated Folder Content Disclosure
High
CVE-2026-49780
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.2 - Authenticated (Customer+) Privilege Escalation
Medium
CVE-2026-49056
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.4 - Unauthenticated Information Exposure
High
CVE-2026-48966
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-48873
Montonio for WooCommerce <= 10.1.2 - Missing Authorization
Medium
CVE-2026-48870
King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.