Medium
CVE-2026-25396
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-23972
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.6.0 - Missing Authorization
High
CVE-2026-25328
Product File Upload for WooCommerce <= 2.2.4 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-25030
Goldish < 3.47 - Unauthenticated PHP Object Injection
High
CVE-2026-3830
Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQL Injection
Medium
CVE-2025-13997
King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure
Medium
CVE-2025-10734
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure
High
CVE-2025-10679
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution
Medium
CVE-2025-10731
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data Export
Medium
CVE-2025-10736
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulation
Medium
CVE-2026-39565
WpTravelly <= 2.1.7 - Missing Authorization
Medium
CVE-2026-3641
Appmax <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint
Medium
CVE-2026-3474
EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter
Critical
CVE-2026-32522
WooCommerce Support Ticket System < 18.5 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-31921
Product Rearrange for WooCommerce <= 1.2.2 - Missing Authorization
Medium
CVE-2026-25304
Jaroti < 1.4.8 - Reflected Cross-Site Scripting
Medium
CVE-2026-25351
MyMedi < 1.7.7 - Reflected Cross-Site Scripting
Medium
CVE-2026-25365
Kargo Takip < 0.2.4 - Missing Authorization
Medium
CVE-2026-25350
Miti < 1.5.3 - Reflected Cross-Site Scripting
Medium
CVE-2026-32528
Riode | Multi-Purpose WooCommerce < 1.6.29 - Reflected Cross-Site Scripting
High
CVE-2026-31920
Product Rearrange for WooCommerce <= 1.2.2 - Unauthenticated SQL Injection
Medium
CVE-2026-25349
Loobek < 1.5.2 - Reflected Cross-Site Scripting
High
CVE-2026-32526
Abandoned Cart Recovery for WooCommerce <= 1.1.10 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-4432
YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Insecure Direct Object Reference to Wishlist Rename
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.