Medium
CVE-2026-25354
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-25356
Yobazar < 1.6.7 - Reflected Cross-Site Scripting
High
CVE-2026-25371
Lumise Product Designer < 2.0.9 - Unauthenticated SQL Injection
Medium
CVE-2026-25361
Event Booking Manager for WooCommerce <= 5.1.4 - Reflected Cross-Site Scripting
Medium
CVE-2026-32441
Comments Import & Export <= 2.4.9 - Missing Authorization
Critical
CVE-2026-32520
RewardsWP – Loyalty Points & Referral Program for WooCommerce <= 1.0.4 - Unauthenticated Privilege Escalation
Medium
CVE-2026-2421
ilGhera Carta Docente for WooCommerce <= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter
Medium
CVE-2026-25317
Print Invoice & Delivery Notes for WooCommerce <= 5.9.0 - Missing Authorization
High
CVE-2026-25443
Fraud Prevention For WooCommerce and EDD <= 2.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
High
CVE-2026-24993
Advanced Reporting & Statistics for WooCommerce – Orders, Products & Customers Reporting <= 4.1.3 - Unauthenticated SQL Injection
Medium
CVE-2026-1926
Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation
Medium
CVE-2026-25455
Product Slider, Product Grid, Product Masonry <= 1.13.61 - Missing Authorization
Medium
CVE-2026-32586
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools < 7.11.3 - Missing Authorization
Medium
CVE-2026-2373
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure
High
CVE-2026-2579
WowStore – Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter
Medium
CVE-2026-25469
ViaBill – WooCommerce < 1.1.70 - Missing Authorization to Unauthenticated Settings Change
High
CVE-2026-27045
WooCommerce Infinite Scroll <= 1.6.2 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-24359
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Missing Authorization
High
CVE-2026-27040
WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.31 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2026-45211
APIExperts Square for WooCommerce <= 4.7.1 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-27046
StoreCustomizer – A plugin to Customize all WooCommerce Pages <= 2.6.3 - Missing Authorization
Medium
CVE-2026-27039
WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.31 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-39496
YayMail <= 4.3.3 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-32459
UpsellWP – WooCommerce Upsell and Related Products Offers <= 2.2.4 - Authenticated (Shop manager+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.