Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,137

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,112

Newly disclosed

Feed last synced

1 hr ago

Data freshness

woocommerce security

Every published CVE affecting woocommerce

This list contains every CVE that names woocommerce as an affected product. Records come from the official CVE feeds maintained by MITRE and NIST. Each record includes a CVSS severity score, the affected version range, and a link to the full NVD entry. New records usually appear here within minutes of publication.

Third-party plugins, extensions, and add-ons built on top of woocommerce are included alongside the core product. In most CMS ecosystems, the majority of CVEs come from the extension layer rather than the core application itself. Searching by component name is just as important as searching by platform name.

Understanding CVSS scores

Severity ratings explained

Every CVE has a CVSS 3.x score from 0 to 10. The score is based on how the vulnerability can be reached (over the network or locally), how complex the exploit is, what access an attacker needs beforehand, whether a victim has to do something first, and the impact on confidentiality, integrity, and availability if the attack succeeds.

Critical 9.0–10.0 Remote, no auth, max impact

High 7.0–8.9 Serious, remotely exploitable

Medium 4.0–6.9 Often requires auth or conditions

Low 0.1–3.9 Limited exploitability or impact

Search by component name, vendor, or keyword to filter this list. Click any CVE ID to see the full record. If your installed version falls within the affected range, update immediately or check the vendor's security advisory.

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-9766	medium	4.3/10	Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action	Sep 19, 2026 yesterday
CVE-2026-75959	medium	4.9/10	GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter	Sep 19, 2026 yesterday
CVE-2026-12402	medium	4.4/10	OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting	Sep 19, 2026 yesterday
CVE-2026-9832	medium	5.3/10	Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint	Sep 19, 2026 yesterday
CVE-2026-11899	medium	4.3/10	PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler	Sep 19, 2026 yesterday
CVE-2026-84025	—	—	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR	Sep 12, 2026 8d ago
CVE-2026-84024	—	—	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF	Sep 12, 2026 8d ago
CVE-2026-84023	—	—	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF	Sep 12, 2026 8d ago
CVE-2026-81789	high	8.6/10	WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability	Sep 10, 2026 9d ago
CVE-2026-8615	medium	4.3/10	ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function	Sep 9, 2026 11d ago
CVE-2026-76009	high	8.1/10	Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint	Sep 9, 2026 11d ago
CVE-2026-81543	high	8.8/10	Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	Sep 5, 2026 15d ago
CVE-2026-84849	medium	6.5/10	WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability	Sep 3, 2026 16d ago
CVE-2026-81280	medium	6.5/10	WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability	Aug 31, 2026 19d ago
CVE-2026-15369	critical	9.8/10	Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout	Aug 29, 2026 21d ago
CVE-2026-6176	high	7.2/10	Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form	Aug 28, 2026 22d ago
CVE-2026-81277	high	8.5/10	WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability	Aug 27, 2026 23d ago
CVE-2026-78283	high	7.1/10	WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability	Aug 27, 2026 23d ago
CVE-2026-27330	high	8.6/10	WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability	Aug 27, 2026 23d ago
CVE-2026-78137	—	—	StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart	Aug 27, 2026 24d ago
CVE-2026-18884	high	7.5/10	WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters	Aug 26, 2026 25d ago
CVE-2026-32558	critical	9.8/10	WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability	Aug 24, 2026 26d ago
CVE-2026-32477	high	8.6/10	WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability	Aug 24, 2026 26d ago
CVE-2026-28171	high	8.6/10	WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability	Aug 24, 2026 26d ago
CVE-2026-14853	—	—	WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization	Aug 23, 2026 28d ago
CVE-2026-18027	medium	6.5/10	WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter	Aug 22, 2026 28d ago
CVE-2026-66611	high	7.1/10	WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability	Aug 20, 2026 1mo ago
CVE-2026-74009	medium	5.3/10	WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73398	medium	6.5/10	WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73396	high	7.1/10	WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability	Aug 18, 2026 1mo ago