Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,462

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,094

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 301–330 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-25318	medium	4.3/10	WordPress WiserReview Product Reviews for WooCommerce plugin <= 2.9 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-24375	medium	5.3/10	WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability	Feb 19, 2026 6mo ago
CVE-2026-22333	high	7.2/10	WordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerability	Feb 19, 2026 6mo ago
CVE-2026-1455	medium	4.3/10	Whatsiplus Scheduled Notification for Woocommerce <= 1.0.1 - Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX Action	Feb 19, 2026 6mo ago
CVE-2025-14357	medium	5.3/10	Mega Store Woocommerce <= 5.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change	Feb 19, 2026 6mo ago
CVE-2025-12975	high	7.2/10	CTX Feed – WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation	Feb 19, 2026 6mo ago
CVE-2025-13930	medium	5.3/10	Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion	Feb 19, 2026 6mo ago
CVE-2025-14294	medium	5.3/10	Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification	Feb 19, 2026 6mo ago
CVE-2025-12500	medium	5.3/10	Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.1 - Unauthenticated Limited File Upload	Feb 19, 2026 6mo ago
CVE-2025-12375	medium	6.4/10	Printful Integration for WooCommerce <= 2.2.11 - Authenticated (Contributor+) Server-Side Request Forgery	Feb 19, 2026 6mo ago
CVE-2026-2386	medium	4.3/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'	Feb 18, 2026 6mo ago
CVE-2026-2296	high	7.2/10	Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter	Feb 18, 2026 6mo ago
CVE-2026-2019	high	7.2/10	Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting	Feb 18, 2026 6mo ago
CVE-2026-1906	medium	4.3/10	PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification	Feb 18, 2026 6mo ago
CVE-2026-1925	medium	4.3/10	EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification	Feb 18, 2026 6mo ago
CVE-2025-12075	medium	4.3/10	Order Splitter for WooCommerce <= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure	Feb 18, 2026 6mo ago
CVE-2026-2592	high	7.7/10	Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update	Feb 17, 2026 6mo ago
CVE-2026-1988	high	7.5/10	Flexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute	Feb 14, 2026 6mo ago
CVE-2026-0692	high	7.5/10	BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation	Feb 14, 2026 6mo ago
CVE-2026-1316	high	7.2/10	Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter	Feb 12, 2026 6mo ago
CVE-2025-13391	medium	5.8/10	Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion	Feb 11, 2026 6mo ago
CVE-2026-1748	medium	4.3/10	Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposure	Feb 11, 2026 6mo ago
CVE-2025-15147	medium	4.3/10	WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment	Feb 9, 2026 6mo ago
CVE-2026-0845	high	7.2/10	WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update	Feb 9, 2026 6mo ago
CVE-2026-1370	medium	4.9/10	SIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' Parameter	Feb 4, 2026 6mo ago
CVE-2026-0679	medium	5.3/10	Fortis for WooCommerce <= 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint	Feb 4, 2026 6mo ago
CVE-2025-15260	medium	6.5/10	MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification	Feb 4, 2026 6mo ago
CVE-2025-15482	medium	5.3/10	Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure	Feb 4, 2026 6mo ago
CVE-2026-24992	medium	5.3/10	WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.2 - Sensitive Data Exposure vulnerability	Feb 3, 2026 6mo ago
CVE-2026-0702	high	7.5/10	VidShop – Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'	Jan 28, 2026 7mo ago