Medium
CVE-2025-14755
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2025-14767
WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' Attribute
Medium
CVE-2026-45217
Payment Gateway of Stripe for WooCommerce <= 5.0.7 - Missing Authorization
Medium
CVE-2026-42725
Checkout Files Upload for WooCommerce <= 2.2.5 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-45209
MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce <= 2.161 - Missing Authorization
High
CVE-2026-45216
Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management <= 8.85.0 - Authenticated (Contributor+) Privilege Escalation
Medium
CVE-2026-7626
Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields
Medium
CVE-2026-42664
AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 - Missing Authorization
Medium
CVE-2026-27415
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery
High
CVE-2026-42773
eMagicOne Store Manager for WooCommerce <= 1.3.2 - Unauthenticated SQL Injection
Medium
CVE-2026-27329
YITH WooCommerce Wishlist <= 4.12.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-7862
Eupago Gateway For Woocommerce <= 4.7.1 - Missing Authorization to Unauthenticated Arbitrary Refund Initiation
Medium
CVE-2026-3208
Mercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure
Critical
CVE-2026-5294
GeekyBot <= 1.2.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Action
High
CVE-2026-3456
GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'
Medium
CVE-2026-5957
EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter
High
CVE-2026-40797
WebinarIgnition < 4.09.86 - Unauthenticated SQL Injection
Medium
CVE-2026-0703
NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode
Medium
CVE-2026-6447
Call for Price for WooCommerce <= 4.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings
High
CVE-2026-2554
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion
Medium
CVE-2026-3504
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint
Medium
CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Medium
CVE-2026-40776
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.8 - Missing Authorization
Medium
CVE-2026-42654
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.5 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.