Medium
CVE-2025-64382
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2025-66089
Product Feed for WooCommerce <= 2.3.1 - Missing Authorization
Medium
CVE-2025-64296
Facebook for WooCommerce <= 3.5.7 - Missing Authorization to Unauthenticated Notification Dismissal
Medium
CVE-2025-49042
WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting
High
CVE-2025-11735
HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.1 - Unauthenticated SQL Injection via `phrase` Parameter
Medium
CVE-2025-11269
Product Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-11823
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11897
The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'
High
CVE-2025-8416
Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection
High
CVE-2025-12095
Simple Registration for WooCommerce <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approval
Low
CVE-2025-11888
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update
Medium
CVE-2025-12017
VNPAY for Woocommerce <= 1.0.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-12096
Simple Excel Pricelist for WooCommerce <= 1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2025-6440
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
High
CVE-2025-10861
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-10570
Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund
Critical
CVE-2025-6325
King Addons for Elementor <= 51.1.36 - Unauthenticated Privilege Escalation
Critical
CVE-2025-6327
King Addons for Elementor <= 51.1.36 - Unauthenticated Arbitrary File Upload
High
CVE-2025-11237
Make Email Customizer for WooCommerce <= 1.0.6 - Authenticated (Subscriber+) Arbitrary Options Update
Medium
CVE-2025-49908
WPC Countdown Timer for WooCommerce <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62969
NextMove Lite <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64380
Booster for WooCommerce <= 7.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11741
WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure
High
CVE-2025-11691
PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection
An unauthenticated SQL injection vulnerability in PPOM for WooCommerce allows attackers to extract sensitive database information when Legacy Price Calculations are enabled.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.