Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

339,760

All time

Critical · Active

10,860

CVSS ≥ 9.0

New · 14 days

2,618

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 361–390 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-67580	medium	5.3/10	WordPress Constant Contact + WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago
CVE-2025-67564	medium	5.3/10	WordPress Pixel Manager for WooCommerce plugin <= 1.51.1 - Sensitive Data Exposure vulnerability	Dec 9, 2025 7mo ago
CVE-2025-67542	medium	6.5/10	WordPress Multi-Step Checkout for WooCommerce plugin <= 2.33 - Cross Site Scripting (XSS) vulnerability	Dec 9, 2025 7mo ago
CVE-2025-66528	medium	4.3/10	WordPress Thank You Page Customizer for WooCommerce plugin <= 1.1.8 - Broken Access Control vulnerability	Dec 9, 2025 7mo ago
CVE-2025-12091	medium	4.3/10	Search, Filters & Merchandising for WooCommerce <= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation	Dec 6, 2025 7mo ago
CVE-2025-13137	medium	6.1/10	Live Sales Notification for Woocommerce – Woomotiv <= 3.6.3 - Reflected Cross-Site Scripting	Dec 6, 2025 7mo ago
CVE-2025-12130	medium	4.3/10	WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion	Dec 5, 2025 7mo ago
CVE-2025-12191	medium	5.4/10	PDF Catalog for WooCommerce <= 1.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting	Dec 5, 2025 7mo ago
CVE-2025-11727	high	7.2/10	Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting	Dec 4, 2025 7mo ago
CVE-2025-13109	medium	4.3/10	HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'	Dec 3, 2025 7mo ago
CVE-2025-13387	high	7.2/10	Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting	Dec 2, 2025 7mo ago
CVE-2025-12584	medium	5.3/10	Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure	Nov 27, 2025 7mo ago
CVE-2025-13157	medium	5.3/10	QODE Wishlist for WooCommerce <= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update	Nov 27, 2025 7mo ago
CVE-2025-13441	medium	5.3/10	Hide Category by User Role for WooCommerce <= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing	Nov 27, 2025 7mo ago
CVE-2025-12123	medium	6.1/10	Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting	Nov 27, 2025 7mo ago
CVE-2025-7820	high	7.5/10	SKT PayPal for WooCommerce <= 1.4 - Unauthenticated Payment Bypass	Nov 27, 2025 7mo ago
CVE-2025-12634	medium	4.3/10	Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update	Nov 25, 2025 7mo ago
CVE-2025-13389	medium	5.3/10	Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure	Nov 25, 2025 7mo ago
CVE-2025-12040	medium	6.5/10	Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation	Nov 25, 2025 7mo ago
CVE-2025-13452	medium	4.3/10	Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages	Nov 25, 2025 7mo ago
CVE-2025-10144	medium	6.5/10	Perfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection	Nov 24, 2025 7mo ago
CVE-2025-66114	medium	5.3/10	WordPress Show Variations as Single Products Woocommerce plugin <= 2.0 - Broken Access Control vulnerability	Nov 21, 2025 7mo ago
CVE-2025-66109	medium	5.3/10	WordPress Cart Weight for WooCommerce plugin <= 1.9.11 - Broken Access Control vulnerability	Nov 21, 2025 7mo ago
CVE-2025-66089	medium	4.3/10	WordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerability	Nov 21, 2025 7mo ago
CVE-2025-66071	medium	5.3/10	WordPress Custom Order Numbers for WooCommerce plugin <= 1.11.0 - Broken Access Control vulnerability	Nov 21, 2025 7mo ago
CVE-2025-66069	medium	4.3/10	WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability	Nov 21, 2025 7mo ago
CVE-2025-13156	high	8.8/10	Vitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution	Nov 21, 2025 7mo ago
CVE-2025-12039	medium	5.3/10	BigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() Exposure	Nov 21, 2025 7mo ago
CVE-2025-12881	medium	5.4/10	Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read	Nov 21, 2025 7mo ago
CVE-2025-12086	medium	4.3/10	Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation	Nov 21, 2025 7mo ago