Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,161

All time

Critical · Active

12,434

CVSS ≥ 9.0

New · 14 days

2,120

Newly disclosed

Feed last synced

40 mins ago

Data freshness

Showing 331–360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-2592	high	7.7/10	Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update	Feb 17, 2026 7mo ago
CVE-2026-1988	high	7.5/10	Flexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute	Feb 14, 2026 7mo ago
CVE-2026-0692	high	7.5/10	BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation	Feb 14, 2026 7mo ago
CVE-2026-1316	high	7.2/10	Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter	Feb 12, 2026 7mo ago
CVE-2025-13391	medium	5.8/10	Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion	Feb 11, 2026 7mo ago
CVE-2026-1748	medium	4.3/10	Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposure	Feb 11, 2026 7mo ago
CVE-2025-15147	medium	4.3/10	WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment	Feb 9, 2026 7mo ago
CVE-2026-0845	high	7.2/10	WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update	Feb 9, 2026 7mo ago
CVE-2026-1370	medium	4.9/10	SIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' Parameter	Feb 4, 2026 7mo ago
CVE-2026-0679	medium	5.3/10	Fortis for WooCommerce <= 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint	Feb 4, 2026 7mo ago
CVE-2025-15260	medium	6.5/10	MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification	Feb 4, 2026 7mo ago
CVE-2025-15482	medium	5.3/10	Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure	Feb 4, 2026 7mo ago
CVE-2026-24992	medium	5.3/10	WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.2 - Sensitive Data Exposure vulnerability	Feb 3, 2026 7mo ago
CVE-2026-0702	high	7.5/10	VidShop – Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'	Jan 28, 2026 7mo ago
CVE-2026-1381	medium	4.4/10	Order Minimum/Maximum Amount Limits for WooCommerce <= 4.6.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Hide Add to Cart Content Fields	Jan 28, 2026 7mo ago
CVE-2025-14971	medium	5.3/10	Link Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/Cancellation	Jan 27, 2026 7mo ago
CVE-2025-14843	medium	5.3/10	Wizit Gateway for WooCommerce <= 1.3.1 - Missing Authentication to Unauthenticated Arbitrary Order Cancellation	Jan 24, 2026 7mo ago
CVE-2026-24625	medium	5.3/10	WordPress File Uploads Addon for WooCommerce plugin <= 1.7.3 - Broken Access Control vulnerability	Jan 23, 2026 8mo ago
CVE-2026-24606	medium	5.3/10	WordPress Bayarcash WooCommerce plugin <= 4.3.13 - Broken Access Control vulnerability	Jan 23, 2026 8mo ago
CVE-2026-24585	medium	6.5/10	WordPress Hyyan WooCommerce Polylang Integration plugin <= 1.5.0 - Broken Access Control vulnerability	Jan 23, 2026 8mo ago
CVE-2026-24583	medium	5.3/10	WordPress SumUp Payment Gateway For WooCommerce plugin <= 2.7.9 - Broken Access Control vulnerability	Jan 23, 2026 8mo ago
CVE-2026-24581	medium	5.4/10	WordPress Points and Rewards for WooCommerce plugin <= 2.9.5 - Broken Access Control vulnerability	Jan 23, 2026 8mo ago
CVE-2026-24562	medium	5.3/10	WordPress Ryviu – Product Reviews for WooCommerce plugin <= 3.1.26 - Broken Access Control vulnerability	Jan 23, 2026 8mo ago
CVE-2026-24553	medium	4.3/10	WordPress Fraud Prevention For Woocommerce plugin <= 2.3.2 - Sensitive Data Exposure vulnerability	Jan 23, 2026 8mo ago
CVE-2026-24526	medium	6.5/10	WordPress Email Inquiry & Cart Options for WooCommerce plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability	Jan 23, 2026 8mo ago
CVE-2026-24366	medium	5.3/10	WordPress YITH WooCommerce Request A Quote plugin <= 2.46.0 - Broken Access Control vulnerability	Jan 22, 2026 8mo ago
CVE-2026-24365	medium	5.4/10	WordPress Stock Manager for WooCommerce plugin < 3.6.0 - Cross Site Request Forgery (CSRF) vulnerability	Jan 22, 2026 8mo ago
CVE-2025-69052	critical	9.8/10	WordPress Registration & Login with Mobile Phone Number for WooCommerce plugin <= 1.3.1 - Broken Access Control vulnerability	Jan 22, 2026 8mo ago
CVE-2025-69045	high	8.5/10	WordPress FooEvents for WooCommerce plugin <= 1.20.4 - SQL Injection vulnerability	Jan 22, 2026 8mo ago
CVE-2025-69004	high	8.1/10	WordPress Bajaar - Highly Customizable WooCommerce WordPress Theme theme <= 2.1.0 - Local File Inclusion vulnerability	Jan 22, 2026 8mo ago