Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,463

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,094

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 451–480 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-13109	medium	4.3/10	HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'	Dec 3, 2025 9mo ago
CVE-2025-13387	high	7.2/10	Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting	Dec 2, 2025 9mo ago
CVE-2025-12584	medium	5.3/10	Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure	Nov 27, 2025 9mo ago
CVE-2025-13157	medium	5.3/10	QODE Wishlist for WooCommerce <= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update	Nov 27, 2025 9mo ago
CVE-2025-13441	medium	5.3/10	Hide Category by User Role for WooCommerce <= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing	Nov 27, 2025 9mo ago
CVE-2025-12123	medium	6.1/10	Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting	Nov 27, 2025 9mo ago
CVE-2025-7820	high	7.5/10	SKT PayPal for WooCommerce <= 1.4 - Unauthenticated Payment Bypass	Nov 27, 2025 9mo ago
CVE-2025-12634	medium	4.3/10	Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update	Nov 25, 2025 9mo ago
CVE-2025-13389	medium	5.3/10	Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure	Nov 25, 2025 9mo ago
CVE-2025-12040	medium	6.5/10	Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation	Nov 25, 2025 9mo ago
CVE-2025-13452	medium	4.3/10	Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages	Nov 25, 2025 9mo ago
CVE-2025-10144	medium	6.5/10	Perfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection	Nov 24, 2025 9mo ago
CVE-2025-66114	medium	5.3/10	WordPress Show Variations as Single Products Woocommerce plugin <= 2.0 - Broken Access Control vulnerability	Nov 21, 2025 9mo ago
CVE-2025-66109	medium	5.3/10	WordPress Cart Weight for WooCommerce plugin <= 1.9.11 - Broken Access Control vulnerability	Nov 21, 2025 9mo ago
CVE-2025-66089	medium	4.3/10	WordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerability	Nov 21, 2025 9mo ago
CVE-2025-66071	medium	5.3/10	WordPress Custom Order Numbers for WooCommerce plugin <= 1.11.0 - Broken Access Control vulnerability	Nov 21, 2025 9mo ago
CVE-2025-66069	medium	4.3/10	WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability	Nov 21, 2025 9mo ago
CVE-2025-13156	high	8.8/10	Vitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution	Nov 21, 2025 9mo ago
CVE-2025-12039	medium	5.3/10	BigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() Exposure	Nov 21, 2025 9mo ago
CVE-2025-12881	medium	5.4/10	Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read	Nov 21, 2025 9mo ago
CVE-2025-12086	medium	4.3/10	Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation	Nov 21, 2025 9mo ago
CVE-2025-12878	medium	6.4/10	FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode	Nov 19, 2025 9mo ago
CVE-2025-12427	medium	5.3/10	YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename	Nov 19, 2025 9mo ago
CVE-2025-12777	medium	5.3/10	YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion	Nov 19, 2025 9mo ago
CVE-2025-12545	medium	5.3/10	Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information Exposure	Nov 18, 2025 9mo ago
CVE-2025-12639	medium	4.3/10	wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions \| for WooCommerce <= 1.2.2 - Missing Authorization to Sensitive Information Disclosure	Nov 18, 2025 9mo ago
CVE-2025-12392	medium	5.3/10	Cryptocurrency Payment Gateway for WooCommerce <= 2.0.25 - Missing Authorization to Unauthenticated Tracking Status Update	Nov 18, 2025 9mo ago
CVE-2025-12955	high	7.5/10	Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure	Nov 18, 2025 9mo ago
CVE-2025-4212	high	7.2/10	Checkout Files Upload for WooCommerce <= 2.2.1 - Unauthenticated Stored Cross-Site Scripting	Nov 18, 2025 9mo ago
CVE-2025-13088	high	8.8/10	Category and Product Woocommerce Tabs <= 1.0 - Authenticated (Contributor+) Local File Inclusion	Nov 18, 2025 9mo ago