Medium
CVE-2026-39662
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-23541
Mail Mint <= 1.19.4 - Missing Authorization
High
CVE-2026-23549
WpEvently <= 5.1.1 - Unauthenticated PHP Object Injection
Medium
CVE-2025-14294
Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification
Medium
CVE-2026-32372
ShopBuilder – Elementor WooCommerce Builder Addons <= 3.2.4 - Unauthenticated Information Exposure
Medium
CVE-2026-39668
Book Previewer for Woocommerce <= 1.0.6 - Missing Authorization
High
CVE-2026-32384
WpBookingly <= 1.2.9 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-1938
YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint
Low
CVE-2026-1831
YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation
Medium
CVE-2026-1943
YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements
High
CVE-2026-1937
YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action
High
CVE-2026-2296
Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter
High
CVE-2026-2019
Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting
Medium
CVE-2026-1906
PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification
Medium
CVE-2025-12075
Order Splitter for WooCommerce <= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
Medium
CVE-2026-1925
EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification
High
CVE-2026-1714
ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action
High
CVE-2026-1426
Advanced AJAX Product Filters <= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer Compatibility
High
CVE-2026-2592
Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update
High
CVE-2026-22354
Woocommerce Category Banner Management <= 2.5.1 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-39656
Razorpay for WooCommerce <= 4.8.3 - Missing Authorization
High
CVE-2026-39645
GlobalPayments WooCommerce <= 1.18.3 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-39643
Payment Plugins for PayPal WooCommerce <= 2.0.13 - Missing Authorization
Medium
CVE-2026-32354
WpEvently < 5.1.9 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.