Medium
CVE-2026-100149
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2026-78371
File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-93549
CoCart 4.9.0 - 4.9.6 - Cross-Site Request Forgery to Privilege Escalation
Medium
CVE-2026-13607
File Uploads Addon for WooCommerce <= 1.7.6 - Missing Authorization
Medium
CVE-2026-104118
Razorpay for WooCommerce <= 4.8.7 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-12951
MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter
High
CVE-2026-97663
Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Medium
CVE-2026-84925
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter
High
CVE-2026-10026
CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution
High
CVE-2026-97268
Premmerce Wishlist for WooCommerce <= 1.1.13 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-62063
Travelly – Tour & Travel Booking Manager for WooCommerce <= 2.3.1 - Missing Authorization
Medium
CVE-2026-102379
BuildKit – Product Builder for WooCommerce – Custom PC Builder <= 1.0.28 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-102390
AFFI – Affiliate Marketing for WooCommerce <= 1.0.9 - Missing Authorization
Medium
CVE-2026-97297
Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program <= 4.6.3 - Missing Authorization
Medium
CVE-2026-97269
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-97273
Premmerce Wishlist for WooCommerce <= 1.1.13 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-94390
Hide Shipping Method For WooCommerce <= 1.5.4 - Authenticated (Editor+) PHP Object Injection
Medium
CVE-2026-100517
Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-92437
Mailchimp for WooCommerce <= 6.2 - Missing Authorization
High
CVE-2026-89236
SaveTo Wishlist Lite <= 1.1.4 - Unauthenticated SQL Injection
High
CVE-2026-92244
PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
High
CVE-2026-95687
WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint
High
CVE-2026-94171
CURCY – Multi Currency for WooCommerce 2.2.18 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-102392
Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 - Authenticated (Shop Manager+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.