Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

339,732

All time

Critical · Active

10,857

CVSS ≥ 9.0

New · 14 days

2,595

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 331–360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-60071	high	8.1/10	WordPress Riode \| Multi-Purpose WooCommerce theme <= 1.6.23 - Local File Inclusion vulnerability	Dec 18, 2025 7mo ago
CVE-2025-58951	critical	9.3/10	WordPress Advance Seat Reservation Management for WooCommerce plugin <= 3.1 - SQL Injection vulnerability	Dec 18, 2025 7mo ago
CVE-2025-49379	high	7.2/10	WordPress Custom Fields Account Registration For Woocommerce plugin <= 1.2 - Privilege Escalation vulnerability	Dec 18, 2025 7mo ago
CVE-2025-13231	medium	6.5/10	Fancy Product Designer \| WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition	Dec 16, 2025 7mo ago
CVE-2025-67929	medium	5.3/10	WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-66128	medium	5.3/10	WordPress Sendinblue for WooCommerce plugin <= 4.0.49 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-64638	medium	5.3/10	WordPress OnPay.io for WooCommerce plugin <= 1.0.47 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-54004	low	2.7/10	WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.24 - Broken Access Control vulnerability	Dec 16, 2025 7mo ago
CVE-2025-13439	medium	5.9/10	Fancy Product Designer \| WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter	Dec 16, 2025 7mo ago
CVE-2025-9207	medium	5.3/10	TI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injection	Dec 13, 2025 7mo ago
CVE-2025-14365	medium	5.3/10	Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category Deletion	Dec 13, 2025 7mo ago
CVE-2025-8617	medium	6.4/10	YITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view Shortcode	Dec 13, 2025 7mo ago
CVE-2025-13077	high	7.5/10	افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL Injection	Dec 13, 2025 7mo ago
CVE-2025-14366	medium	5.3/10	Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation	Dec 13, 2025 7mo ago
CVE-2025-14169	high	7.5/10	FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injection	Dec 12, 2025 7mo ago
CVE-2025-12655	medium	5.3/10	Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write	Dec 12, 2025 7mo ago
CVE-2025-13314	medium	5.3/10	Product Filtering by Categories, Tags, Price Range for WooCommerce <= 1.1.6 - Missing Authorization to Unauthenticated Plugin Settings Modification	Dec 12, 2025 7mo ago
CVE-2025-13440	medium	5.3/10	Premmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion	Dec 12, 2025 7mo ago
CVE-2025-14165	medium	4.3/10	Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update	Dec 12, 2025 7mo ago
CVE-2025-12783	medium	4.3/10	Premmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update	Dec 12, 2025 7mo ago
CVE-2025-12883	medium	5.3/10	Campay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment Bypass	Dec 12, 2025 7mo ago
CVE-2025-13339	high	7.5/10	Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read	Dec 10, 2025 7mo ago
CVE-2025-13924	medium	4.3/10	Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publication	Dec 9, 2025 7mo ago
CVE-2025-63024	medium	5.4/10	WordPress Order Delivery Date for WooCommerce plugin <= 4.3.1 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago
CVE-2025-63023	medium	5.3/10	WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.0.53 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago
CVE-2025-63015	medium	4.3/10	WordPress WooCommerce Payment Gateway – Paysera plugin <= 3.10.0 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago
CVE-2025-62995	medium	4.3/10	WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.12 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago
CVE-2025-62870	medium	5.3/10	WordPress Eupago Gateway For Woocommerce plugin <= 4.7.1 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago
CVE-2025-62151	medium	5.3/10	WordPress Virtuaria PagBank / PagSeguro para Woocommerce plugin <= 3.6.3 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago
CVE-2025-67589	medium	4.3/10	WordPress WooCommerce PDF Invoices & Packing Slips plugin <= 4.9.1 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago