Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

355,425

All time

Critical · Active

12,667

CVSS ≥ 9.0

New · 14 days

1,947

Newly disclosed

Feed last synced

1 hr ago

Data freshness

woocommerce security

Every published CVE affecting woocommerce

This list contains every CVE that names woocommerce as an affected product. Records come from the official CVE feeds maintained by MITRE and NIST. Each record includes a CVSS severity score, the affected version range, and a link to the full NVD entry. New records usually appear here within minutes of publication.

Third-party plugins, extensions, and add-ons built on top of woocommerce are included alongside the core product. In most CMS ecosystems, the majority of CVEs come from the extension layer rather than the core application itself. Searching by component name is just as important as searching by platform name.

Understanding CVSS scores

Severity ratings explained

Every CVE has a CVSS 3.x score from 0 to 10. The score is based on how the vulnerability can be reached (over the network or locally), how complex the exploit is, what access an attacker needs beforehand, whether a victim has to do something first, and the impact on confidentiality, integrity, and availability if the attack succeeds.

Critical 9.0–10.0 Remote, no auth, max impact

High 7.0–8.9 Serious, remotely exploitable

Medium 4.0–6.9 Often requires auth or conditions

Low 0.1–3.9 Limited exploitability or impact

Search by component name, vendor, or keyword to filter this list. Click any CVE ID to see the full record. If your installed version falls within the affected range, update immediately or check the vendor's security advisory.

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-87855	critical	9.8/10	JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method	Oct 14, 2026 today
CVE-2026-78193	high	7.5/10	JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection	Oct 14, 2026 today
CVE-2026-93388	critical	9.8/10	Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url	Oct 14, 2026 yesterday
CVE-2026-42718	critical	9.8/10	WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability	Oct 10, 2026 4d ago
CVE-2026-42716	critical	9.8/10	WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability	Oct 10, 2026 4d ago
CVE-2026-106609	high	7.5/10	WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability	Oct 10, 2026 4d ago
CVE-2026-106608	high	7.2/10	WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability	Oct 10, 2026 4d ago
CVE-2026-104398	critical	9.8/10	WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability	Oct 10, 2026 4d ago
CVE-2026-103071	high	7.5/10	WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability	Oct 10, 2026 4d ago
CVE-2026-97340	medium	6.4/10	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field	Oct 10, 2026 4d ago
CVE-2026-93746	high	7.5/10	WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter	Oct 10, 2026 4d ago
CVE-2026-97396	medium	6.4/10	Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint	Oct 10, 2026 4d ago
CVE-2026-94375	medium	5.3/10	Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()	Oct 10, 2026 4d ago
CVE-2026-42714	high	7.6/10	WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability	Oct 7, 2026 7d ago
CVE-2026-105421	medium	5.3/10	WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability	Oct 5, 2026 9d ago
CVE-2026-104118	—	—	Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR	Oct 4, 2026 10d ago
CVE-2026-104313	medium	6.1/10	WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter	Oct 3, 2026 11d ago
CVE-2026-97660	high	7.2/10	WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name	Oct 3, 2026 11d ago
CVE-2026-92437	—	—	Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion	Oct 3, 2026 11d ago
CVE-2026-103888	medium	6.1/10	WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter	Oct 3, 2026 11d ago
CVE-2026-101923	high	8.1/10	Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter	Oct 3, 2026 11d ago
CVE-2026-11399	medium	4.3/10	Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter	Oct 3, 2026 11d ago
CVE-2026-97663	high	7.2/10	Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name	Oct 2, 2026 12d ago
CVE-2026-84925	medium	6.1/10	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter	Oct 2, 2026 12d ago
CVE-2026-97273	high	7.1/10	WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability	Oct 1, 2026 13d ago
CVE-2026-95687	high	8.8/10	WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint	Oct 1, 2026 13d ago
CVE-2026-12241	medium	5.4/10	Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting	Oct 1, 2026 13d ago
CVE-2026-18143	critical	9.8/10	Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler	Sep 26, 2026 18d ago
CVE-2026-93836	high	7.2/10	WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter	Sep 22, 2026 22d ago
CVE-2026-9766	medium	4.3/10	Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action	Sep 19, 2026 25d ago