Critical
CVE-2025-6441
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
High
CVE-2025-49924
Wholesale Suite <= 2.2.4.2 - Authenticated (Shop Manager+) Privilege Escalation
Medium
CVE-2025-6214
Omnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint
Medium
CVE-2025-6215
Omnishop <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint
High
CVE-2025-53213
ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2025-6717
B1.lt for WooCommerce <= 2.2.56 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-6718
B1.lt for WooCommerce <= 2.2.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection
Medium
CVE-2025-5767
Crowdfunding for WooCommerce <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
Medium
CVE-2025-5816
Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship <= 3.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) View Order Tracking Details
Medium
CVE-2025-28999
WooCommerce Shop Page Builder <= 2.27.7 - Reflected Cross-Site Scripting
Medium
CVE-2025-29014
FoodMenu <= 1.20 - Reflected Cross-Site Scripting
Critical
CVE-2025-6222
WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet <= 3.2.6 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-54022
Coupon Affiliates <= 6.4.0 - Cross-Site Request Forgery
Medium
CVE-2025-48299
YayExtra <= 1.5.5 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-53208
Maya Business <= 1.2.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-54041
Wallet System for WooCommerce <= 2.6.7 - Cross-Site Request Forgery
Medium
CVE-2025-54042
WP Post Hide <= 1.0.9 - Cross-Site Request Forgery
Medium
CVE-2025-54030
WooCommerce Google Sheet Connector <= 1.3.20 - Cross-Site Request Forgery
High
CVE-2025-7359
Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block
High
CVE-2025-2800
WP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name'
Medium
CVE-2025-49958
Robokassa payment gateway for Woocommerce <= 1.8.1 - Reflected Cross-Site Scripting
High
CVE-2025-60203
Store Exporter <= 2.7.6 - Unauthenticated Local File Inclusion
High
CVE-2025-60204
WooCommerce Store Toolkit <= 2.4.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-47645
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.