Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

339,646

All time

Critical · Active

10,844

CVSS ≥ 9.0

New · 14 days

2,634

Newly disclosed

Feed last synced

1 hr ago

Data freshness

woocommerce security

Every published CVE affecting woocommerce

This list contains every CVE that names woocommerce as an affected product. Records come from the official CVE feeds maintained by MITRE and NIST. Each record includes a CVSS severity score, the affected version range, and a link to the full NVD entry. New records usually appear here within minutes of publication.

Third-party plugins, extensions, and add-ons built on top of woocommerce are included alongside the core product. In most CMS ecosystems, the majority of CVEs come from the extension layer rather than the core application itself. Searching by component name is just as important as searching by platform name.

Understanding CVSS scores

Severity ratings explained

Every CVE has a CVSS 3.x score from 0 to 10. The score is based on how the vulnerability can be reached (over the network or locally), how complex the exploit is, what access an attacker needs beforehand, whether a victim has to do something first, and the impact on confidentiality, integrity, and availability if the attack succeeds.

Critical 9.0–10.0 Remote, no auth, max impact

High 7.0–8.9 Serious, remotely exploitable

Medium 4.0–6.9 Often requires auth or conditions

Low 0.1–3.9 Limited exploitability or impact

Search by component name, vendor, or keyword to filter this list. Click any CVE ID to see the full record. If your installed version falls within the affected range, update immediately or check the vendor's security advisory.

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-12393	—	—	WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR	Jul 17, 2026 today
CVE-2026-11324	medium	6.1/10	WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'	Jul 17, 2026 today
CVE-2026-12492	—	—	Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user	Jul 16, 2026 yesterday
CVE-2026-12753	high	7.5/10	Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter	Jul 16, 2026 yesterday
CVE-2026-61958	medium	5.4/10	WordPress License Manager for WooCommerce plugin <= 3.0.17 - Arbitrary Content Deletion vulnerability	Jul 13, 2026 4d ago
CVE-2026-61952	medium	4.9/10	WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57810	high	8.5/10	WordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerability	Jul 13, 2026 4d ago
CVE-2026-57773	high	7.6/10	WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability	Jul 13, 2026 4d ago
CVE-2026-57709	high	8.6/10	WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbitrary File Deletion vulnerability	Jul 13, 2026 4d ago
CVE-2026-57698	medium	6.5/10	WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability	Jul 13, 2026 4d ago
CVE-2026-57424	medium	6.5/10	WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57422	high	7.1/10	WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57419	medium	6.5/10	WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57409	high	7.1/10	WordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57402	medium	6.5/10	WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57400	medium	6.5/10	WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-57396	high	7.1/10	WordPress Free Gifts for WooCommerce plugin <= 13.1.0 - Cross Site Scripting (XSS) vulnerability	Jul 13, 2026 4d ago
CVE-2026-57393	medium	6.5/10	WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Sensitive Data Exposure vulnerability	Jul 13, 2026 4d ago
CVE-2026-57390	medium	6.5/10	WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerability	Jul 13, 2026 4d ago
CVE-2026-6939	high	7.2/10	CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter	Jul 11, 2026 6d ago
CVE-2026-10041	medium	4.3/10	WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers	Jul 11, 2026 6d ago
CVE-2026-10628	medium	4.3/10	Points and Rewards for WooCommerce <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions	Jul 11, 2026 6d ago
CVE-2026-9235	medium	4.3/10	DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions	Jul 9, 2026 8d ago
CVE-2026-9027	medium	5.3/10	CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint	Jul 9, 2026 8d ago
CVE-2026-9240	medium	4.3/10	Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action	Jul 9, 2026 8d ago
CVE-2026-11359	medium	4.3/10	Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation	Jul 9, 2026 8d ago
CVE-2026-13011	medium	6.5/10	ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter	Jul 9, 2026 8d ago
CVE-2026-13771	medium	6.4/10	Customer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute	Jul 9, 2026 8d ago
CVE-2026-3688	high	8.1/10	WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite	Jul 8, 2026 9d ago
CVE-2026-14500	medium	5.3/10	Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter	Jul 8, 2026 9d ago