Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

339,761

All time

Critical · Active

10,860

CVSS ≥ 9.0

New · 14 days

2,607

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 421–450 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-60194	high	7.5/10	WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Local File Inclusion vulnerability	Nov 6, 2025 8mo ago
CVE-2025-60192	high	7.5/10	WordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerability	Nov 6, 2025 8mo ago
CVE-2025-60191	high	7.5/10	WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerability	Nov 6, 2025 8mo ago
CVE-2025-60189	high	7.5/10	WordPress PoloPag – Pix Automático para Woocommerce plugin <= 2.0.9 - Local File Inclusion vulnerability	Nov 6, 2025 8mo ago
CVE-2025-47588	critical	9.1/10	WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.9 - Arbitrary Code Execution vulnerability	Nov 6, 2025 8mo ago
CVE-2025-12469	medium	4.3/10	FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending	Nov 5, 2025 8mo ago
CVE-2025-12468	medium	5.3/10	FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure	Nov 5, 2025 8mo ago
CVE-2025-12389	medium	4.3/10	Import Export For WooCommerce <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update	Nov 4, 2025 8mo ago
CVE-2025-11890	high	7.5/10	Crypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment Bypass	Nov 4, 2025 8mo ago
CVE-2025-64358	medium	4.3/10	WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerability	Oct 31, 2025 8mo ago
CVE-2025-12115	high	7.5/10	WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration	Oct 31, 2025 8mo ago
CVE-2025-10897	high	8.6/10	WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read	Oct 31, 2025 8mo ago
CVE-2025-64290	medium	4.3/10	WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability	Oct 29, 2025 8mo ago
CVE-2025-64289	medium	5.9/10	WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.5 - Cross Site Scripting (XSS) vulnerability	Oct 29, 2025 8mo ago
CVE-2025-64285	medium	5.4/10	WordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Broken Access Control vulnerability	Oct 29, 2025 8mo ago
CVE-2025-64200	medium	5.9/10	WordPress Email Template Customizer for WooCommerce plugin <= 1.2.17 - Cross Site Scripting (XSS) vulnerability	Oct 29, 2025 8mo ago
CVE-2023-7320	medium	5.3/10	WooCommerce <= 7.8.2 - Sensitive Information Exposure	Oct 29, 2025 8mo ago
CVE-2025-49042	medium	5.9/10	WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability	Oct 29, 2025 8mo ago
CVE-2025-64296	medium	5.3/10	WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability	Oct 29, 2025 8mo ago
CVE-2025-11735	high	7.5/10	HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.1 - Unauthenticated SQL Injection via `phrase` Parameter	Oct 28, 2025 8mo ago
CVE-2025-62957	high	7.1/10	WordPress NikanWP WooCommerce Reporting plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62935	medium	4.3/10	WordPress Open Close WooCommerce Store plugin <= 5.0.0 - Broken Access Control vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62903	medium	6.5/10	WordPress WPC Smart Messages for WooCommerce plugin <= 4.2.8 - Cross Site Scripting (XSS) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-62890	medium	4.3/10	WordPress Premmerce Brands for WooCommerce plugin <= 1.2.13 - Cross Site Request Forgery (CSRF) vulnerability	Oct 27, 2025 8mo ago
CVE-2025-11897	medium	6.4/10	The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'	Oct 25, 2025 8mo ago
CVE-2025-12095	high	8.8/10	Simple Registration for WooCommerce <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approval	Oct 25, 2025 8mo ago
CVE-2025-11888	low	2.7/10	ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update	Oct 25, 2025 8mo ago
CVE-2025-11823	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Oct 25, 2025 8mo ago
CVE-2025-10861	high	7.5/10	Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery	Oct 24, 2025 8mo ago
CVE-2025-12017	medium	6.1/10	VNPAY for Woocommerce <= 1.0.0 - Reflected Cross-Site Scripting	Oct 24, 2025 8mo ago