Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

344,169

All time

Critical · Active

11,532

CVSS ≥ 9.0

New · 14 days

2,699

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

woocommerce security

Every published CVE affecting woocommerce

This list contains every CVE that names woocommerce as an affected product. Records come from the official CVE feeds maintained by MITRE and NIST. Each record includes a CVSS severity score, the affected version range, and a link to the full NVD entry. New records usually appear here within minutes of publication.

Third-party plugins, extensions, and add-ons built on top of woocommerce are included alongside the core product. In most CMS ecosystems, the majority of CVEs come from the extension layer rather than the core application itself. Searching by component name is just as important as searching by platform name.

Understanding CVSS scores

Severity ratings explained

Every CVE has a CVSS 3.x score from 0 to 10. The score is based on how the vulnerability can be reached (over the network or locally), how complex the exploit is, what access an attacker needs beforehand, whether a victim has to do something first, and the impact on confidentiality, integrity, and availability if the attack succeeds.

Critical 9.0–10.0 Remote, no auth, max impact

High 7.0–8.9 Serious, remotely exploitable

Medium 4.0–6.9 Often requires auth or conditions

Low 0.1–3.9 Limited exploitability or impact

Search by component name, vendor, or keyword to filter this list. Click any CVE ID to see the full record. If your installed version falls within the affected range, update immediately or check the vendor's security advisory.

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-16620	high	7.5/10	WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode	Aug 6, 2026 today
CVE-2026-16067	medium	5.3/10	Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price	Aug 6, 2026 today
CVE-2026-13399	high	7.5/10	Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order	Aug 6, 2026 today
CVE-2026-12584	high	7.5/10	Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback	Aug 6, 2026 today
CVE-2026-10599	high	7.5/10	Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse	Aug 6, 2026 today
CVE-2026-66711	high	7.1/10	WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 today
CVE-2026-65559	high	7.2/10	WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability	Aug 6, 2026 today
CVE-2026-28180	medium	5.3/10	WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability	Aug 6, 2026 today
CVE-2026-28169	medium	5.3/10	WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability	Aug 6, 2026 today
CVE-2026-28005	critical	9.8/10	WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability	Aug 6, 2026 today
CVE-2026-13153	—	—	Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint	Aug 6, 2026 today
CVE-2026-16054	—	—	Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle	Aug 6, 2026 today
CVE-2026-16981	—	—	DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR	Aug 5, 2026 yesterday
CVE-2026-16940	—	—	Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal	Aug 5, 2026 yesterday
CVE-2026-11421	medium	6.5/10	ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter	Aug 5, 2026 yesterday
CVE-2026-16285	—	—	WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download	Aug 2, 2026 4d ago
CVE-2026-16063	—	—	Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content	Aug 2, 2026 4d ago
CVE-2026-16062	—	—	Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content	Aug 2, 2026 4d ago
CVE-2026-15206	—	—	SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile	Aug 2, 2026 4d ago
CVE-2026-8457	critical	9.8/10	WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT	Aug 1, 2026 5d ago
CVE-2025-14073	medium	5.3/10	WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure	Aug 1, 2026 5d ago
CVE-2026-15414	high	8.8/10	Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta	Aug 1, 2026 6d ago
CVE-2026-15258	—	—	Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter	Jul 31, 2026 6d ago
CVE-2026-15397	high	7.2/10	Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action	Jul 30, 2026 7d ago
CVE-2026-11782	—	—	Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR	Jul 30, 2026 7d ago
CVE-2026-14270	high	8.8/10	Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings	Jul 29, 2026 8d ago
CVE-2026-7436	medium	6.4/10	WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute	Jul 29, 2026 8d ago
CVE-2026-16597	high	7.2/10	GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields	Jul 29, 2026 8d ago
CVE-2025-10656	critical	9.8/10	Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation	Jul 29, 2026 8d ago
CVE-2026-13110	medium	5.3/10	StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action	Jul 28, 2026 9d ago