Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,463

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,094

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 421–450 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-9207	medium	5.3/10	TI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injection	Dec 13, 2025 8mo ago
CVE-2025-14365	medium	5.3/10	Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category Deletion	Dec 13, 2025 8mo ago
CVE-2025-8617	medium	6.4/10	YITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view Shortcode	Dec 13, 2025 8mo ago
CVE-2025-13077	high	7.5/10	افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL Injection	Dec 13, 2025 8mo ago
CVE-2025-14366	medium	5.3/10	Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation	Dec 13, 2025 8mo ago
CVE-2025-14169	high	7.5/10	FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injection	Dec 12, 2025 8mo ago
CVE-2025-12655	medium	5.3/10	Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write	Dec 12, 2025 8mo ago
CVE-2025-13314	medium	5.3/10	Product Filtering by Categories, Tags, Price Range for WooCommerce <= 1.1.6 - Missing Authorization to Unauthenticated Plugin Settings Modification	Dec 12, 2025 8mo ago
CVE-2025-13440	medium	5.3/10	Premmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion	Dec 12, 2025 8mo ago
CVE-2025-14165	medium	4.3/10	Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update	Dec 12, 2025 8mo ago
CVE-2025-12783	medium	4.3/10	Premmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update	Dec 12, 2025 8mo ago
CVE-2025-12883	medium	5.3/10	Campay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment Bypass	Dec 12, 2025 8mo ago
CVE-2025-13339	high	7.5/10	Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read	Dec 10, 2025 8mo ago
CVE-2025-13924	medium	4.3/10	Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publication	Dec 9, 2025 8mo ago
CVE-2025-63024	medium	5.4/10	WordPress Order Delivery Date for WooCommerce plugin <= 4.3.1 - Broken Access Control vulnerability	Dec 9, 2025 8mo ago
CVE-2025-63023	medium	5.3/10	WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.0.53 - Broken Access Control vulnerability	Dec 9, 2025 8mo ago
CVE-2025-63015	medium	4.3/10	WordPress WooCommerce Payment Gateway – Paysera plugin <= 3.10.0 - Broken Access Control vulnerability	Dec 9, 2025 8mo ago
CVE-2025-62995	medium	4.3/10	WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.12 - Broken Access Control vulnerability	Dec 9, 2025 8mo ago
CVE-2025-62870	medium	5.3/10	WordPress Eupago Gateway For Woocommerce plugin <= 4.7.1 - Broken Access Control vulnerability	Dec 9, 2025 8mo ago
CVE-2025-62151	medium	5.3/10	WordPress Virtuaria PagBank / PagSeguro para Woocommerce plugin <= 3.6.3 - Broken Access Control vulnerability	Dec 9, 2025 8mo ago
CVE-2025-67589	medium	4.3/10	WordPress WooCommerce PDF Invoices & Packing Slips plugin <= 4.9.1 - Broken Access Control vulnerability	Dec 9, 2025 8mo ago
CVE-2025-67580	medium	5.3/10	WordPress Constant Contact + WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability	Dec 9, 2025 8mo ago
CVE-2025-67564	medium	5.3/10	WordPress Pixel Manager for WooCommerce plugin <= 1.51.1 - Sensitive Data Exposure vulnerability	Dec 9, 2025 8mo ago
CVE-2025-67542	medium	6.5/10	WordPress Multi-Step Checkout for WooCommerce plugin <= 2.33 - Cross Site Scripting (XSS) vulnerability	Dec 9, 2025 8mo ago
CVE-2025-66528	medium	4.3/10	WordPress Thank You Page Customizer for WooCommerce plugin <= 1.1.8 - Broken Access Control vulnerability	Dec 9, 2025 8mo ago
CVE-2025-12091	medium	4.3/10	Search, Filters & Merchandising for WooCommerce <= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation	Dec 6, 2025 8mo ago
CVE-2025-13137	medium	6.1/10	Live Sales Notification for Woocommerce – Woomotiv <= 3.6.3 - Reflected Cross-Site Scripting	Dec 6, 2025 8mo ago
CVE-2025-12130	medium	4.3/10	WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion	Dec 5, 2025 8mo ago
CVE-2025-12191	medium	5.4/10	PDF Catalog for WooCommerce <= 1.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting	Dec 5, 2025 8mo ago
CVE-2025-11727	high	7.2/10	Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting	Dec 4, 2025 9mo ago