Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

357,894

All time

Critical · Active

12,864

CVSS ≥ 9.0

New · 14 days

929

Newly disclosed

Feed last synced

22 mins ago

Data freshness

woocommerce security

Every published CVE affecting woocommerce

This list contains every CVE that names woocommerce as an affected product. Records come from the official CVE feeds maintained by MITRE and NIST. Each record includes a CVSS severity score, the affected version range, and a link to the full NVD entry. New records usually appear here within minutes of publication.

Third-party plugins, extensions, and add-ons built on top of woocommerce are included alongside the core product. In most CMS ecosystems, the majority of CVEs come from the extension layer rather than the core application itself. Searching by component name is just as important as searching by platform name.

Understanding CVSS scores

Severity ratings explained

Every CVE has a CVSS 3.x score from 0 to 10. The score is based on how the vulnerability can be reached (over the network or locally), how complex the exploit is, what access an attacker needs beforehand, whether a victim has to do something first, and the impact on confidentiality, integrity, and availability if the attack succeeds.

Critical 9.0–10.0 Remote, no auth, max impact

High 7.0–8.9 Serious, remotely exploitable

Medium 4.0–6.9 Often requires auth or conditions

Low 0.1–3.9 Limited exploitability or impact

Search by component name, vendor, or keyword to filter this list. Click any CVE ID to see the full record. If your installed version falls within the affected range, update immediately or check the vendor's security advisory.

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-104926	medium	6.1/10	WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter	Oct 31, 2026 4d ago
CVE-2026-109231	medium	4.3/10	Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change	Oct 31, 2026 4d ago
CVE-2026-119065	high	7.2/10	Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter	Oct 31, 2026 4d ago
CVE-2026-88942	medium	6.1/10	Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter	Oct 31, 2026 4d ago
CVE-2026-107750	high	7.2/10	PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout	Oct 31, 2026 4d ago
CVE-2026-109516	critical	9.8/10	Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token	Oct 29, 2026 6d ago
CVE-2026-103688	—	—	Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload	Oct 28, 2026 7d ago
CVE-2026-15323	high	7.5/10	Product Designer for WooCommerce WordPress \| Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload	Oct 28, 2026 7d ago
CVE-2026-109236	medium	4.8/10	Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter	Oct 28, 2026 7d ago
CVE-2026-115959	medium	5.3/10	WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability	Oct 26, 2026 8d ago
CVE-2026-115960	medium	4.3/10	WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability	Oct 26, 2026 8d ago
CVE-2026-111835	medium	6.5/10	WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability	Oct 21, 2026 13d ago
CVE-2026-109701	high	7.1/10	WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability	Oct 17, 2026 17d ago
CVE-2026-100316	high	7.2/10	European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header	Oct 17, 2026 18d ago
CVE-2026-17031	high	8.1/10	Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID	Oct 15, 2026 20d ago
CVE-2026-87855	critical	9.8/10	JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method	Oct 14, 2026 21d ago
CVE-2026-78193	high	7.5/10	JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection	Oct 14, 2026 21d ago
CVE-2026-93388	critical	9.8/10	Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url	Oct 14, 2026 21d ago
CVE-2026-107863	medium	5.3/10	WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability	Oct 12, 2026 23d ago
CVE-2026-42718	critical	9.8/10	WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability	Oct 10, 2026 24d ago
CVE-2026-42716	critical	9.8/10	WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability	Oct 10, 2026 24d ago
CVE-2026-106609	high	7.5/10	WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability	Oct 10, 2026 24d ago
CVE-2026-106608	high	7.2/10	WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability	Oct 10, 2026 24d ago
CVE-2026-104398	critical	9.8/10	WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability	Oct 10, 2026 24d ago
CVE-2026-103071	high	7.5/10	WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability	Oct 10, 2026 24d ago
CVE-2026-97340	medium	6.4/10	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field	Oct 10, 2026 25d ago
CVE-2026-93746	high	7.5/10	WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter	Oct 10, 2026 25d ago
CVE-2026-97396	medium	6.4/10	Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint	Oct 10, 2026 25d ago
CVE-2026-94375	medium	5.3/10	Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()	Oct 10, 2026 25d ago
CVE-2026-42714	high	7.6/10	WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability	Oct 7, 2026 27d ago