Medium
CVE-2026-0679
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2025-15260
MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification
Medium
CVE-2025-15482
Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14461
Xendit Payment <= 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid
Medium
CVE-2026-1370
SIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' Parameter
Medium
CVE-2026-24946
Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Missing Authorization
Medium
CVE-2026-1447
Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-67547
Konte <= 2.4.6 - Missing Authorization
Medium
CVE-2026-25419
UpsellWP <= 2.2.5 - Missing Authorization
High
CVE-2025-69366
Emerce Core <= 1.8 - Unauthenticated SQL Injection
High
CVE-2026-15298
TelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title
Medium
CVE-2025-15511
Rupantorpay <= 2.0.0 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2026-1381
Order Minimum/Maximum Amount Limits for WooCommerce <= 4.6.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Hide Add to Cart Content Fields
High
CVE-2025-69299
Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery
High
CVE-2026-0702
VidShop – Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'
Medium
CVE-2025-68048
NextMove Lite <= 2.23.0 - Missing Authorization
Medium
CVE-2025-14971
Link Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/Cancellation
Medium
CVE-2026-25316
CartFlows – Checkout & Funnel Builder for WooCommerce <= 2.1.19 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-25318
WiserReview Product Reviews for WooCommerce <= 2.9 - Missing Authorization
Medium
CVE-2026-24526
Email Inquiry & Cart Options for WooCommerce <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-14843
Wizit Gateway for WooCommerce <= 1.3.1 - Missing Authentication to Unauthenticated Arbitrary Order Cancellation
Medium
CVE-2026-24550
Blockons <= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-67969
UPI QR Code Payment Gateway for WooCommerce <= 1.5.1 - Missing Authorization
High
CVE-2025-69295
Coven Core <= 1.3 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.