Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,462

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,095

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

woocommerce security

Every published CVE affecting woocommerce

This list contains every CVE that names woocommerce as an affected product. Records come from the official CVE feeds maintained by MITRE and NIST. Each record includes a CVSS severity score, the affected version range, and a link to the full NVD entry. New records usually appear here within minutes of publication.

Third-party plugins, extensions, and add-ons built on top of woocommerce are included alongside the core product. In most CMS ecosystems, the majority of CVEs come from the extension layer rather than the core application itself. Searching by component name is just as important as searching by platform name.

Understanding CVSS scores

Severity ratings explained

Every CVE has a CVSS 3.x score from 0 to 10. The score is based on how the vulnerability can be reached (over the network or locally), how complex the exploit is, what access an attacker needs beforehand, whether a victim has to do something first, and the impact on confidentiality, integrity, and availability if the attack succeeds.

Critical 9.0–10.0 Remote, no auth, max impact

High 7.0–8.9 Serious, remotely exploitable

Medium 4.0–6.9 Often requires auth or conditions

Low 0.1–3.9 Limited exploitability or impact

Search by component name, vendor, or keyword to filter this list. Click any CVE ID to see the full record. If your installed version falls within the affected range, update immediately or check the vendor's security advisory.

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-15369	critical	9.8/10	Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout	Aug 29, 2026 yesterday
CVE-2026-6176	high	7.2/10	Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form	Aug 28, 2026 2d ago
CVE-2026-81277	high	8.5/10	WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability	Aug 27, 2026 3d ago
CVE-2026-78283	high	7.1/10	WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability	Aug 27, 2026 3d ago
CVE-2026-27330	high	8.6/10	WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability	Aug 27, 2026 3d ago
CVE-2026-78137	—	—	StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart	Aug 27, 2026 3d ago
CVE-2026-18884	high	7.5/10	WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters	Aug 26, 2026 4d ago
CVE-2026-32558	critical	9.8/10	WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability	Aug 24, 2026 6d ago
CVE-2026-32477	high	8.6/10	WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability	Aug 24, 2026 6d ago
CVE-2026-28171	high	8.6/10	WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability	Aug 24, 2026 6d ago
CVE-2026-14853	—	—	WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization	Aug 23, 2026 7d ago
CVE-2026-18027	medium	6.5/10	WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter	Aug 22, 2026 8d ago
CVE-2026-66611	high	7.1/10	WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability	Aug 20, 2026 10d ago
CVE-2026-74009	medium	5.3/10	WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability	Aug 18, 2026 12d ago
CVE-2026-73398	medium	6.5/10	WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability	Aug 18, 2026 12d ago
CVE-2026-73396	high	7.1/10	WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability	Aug 18, 2026 12d ago
CVE-2026-73353	medium	5.3/10	WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability	Aug 13, 2026 17d ago
CVE-2026-73346	high	7.6/10	WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability	Aug 13, 2026 17d ago
CVE-2026-66697	high	7.1/10	WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 17d ago
CVE-2026-66655	high	7.1/10	WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 17d ago
CVE-2026-66468	high	7.1/10	WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 17d ago
CVE-2026-66466	high	7.5/10	WordPress StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability	Aug 13, 2026 17d ago
CVE-2026-66462	high	7.5/10	WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability	Aug 13, 2026 17d ago
CVE-2026-66461	high	7.5/10	WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability	Aug 13, 2026 17d ago
CVE-2026-66436	critical	9.3/10	WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability	Aug 13, 2026 17d ago
CVE-2026-66431	high	7.5/10	WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability	Aug 13, 2026 17d ago
CVE-2026-27345	high	7.5/10	WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability	Aug 13, 2026 17d ago
CVE-2026-18391	—	—	WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection	Aug 12, 2026 18d ago
CVE-2026-16538	—	—	TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up	Aug 12, 2026 18d ago
CVE-2026-15039	—	—	Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload	Aug 12, 2026 18d ago