Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,163

All time

Critical · Active

12,435

CVSS ≥ 9.0

New · 14 days

2,121

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 481–510 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-66069	medium	4.3/10	WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability	Nov 21, 2025 10mo ago
CVE-2025-13156	high	8.8/10	Vitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution	Nov 21, 2025 10mo ago
CVE-2025-12039	medium	5.3/10	BigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() Exposure	Nov 21, 2025 10mo ago
CVE-2025-12881	medium	5.4/10	Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read	Nov 21, 2025 10mo ago
CVE-2025-12086	medium	4.3/10	Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation	Nov 21, 2025 10mo ago
CVE-2025-12878	medium	6.4/10	FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode	Nov 19, 2025 10mo ago
CVE-2025-12427	medium	5.3/10	YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename	Nov 19, 2025 10mo ago
CVE-2025-12777	medium	5.3/10	YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion	Nov 19, 2025 10mo ago
CVE-2025-12545	medium	5.3/10	Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information Exposure	Nov 18, 2025 10mo ago
CVE-2025-12639	medium	4.3/10	wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions \| for WooCommerce <= 1.2.2 - Missing Authorization to Sensitive Information Disclosure	Nov 18, 2025 10mo ago
CVE-2025-12392	medium	5.3/10	Cryptocurrency Payment Gateway for WooCommerce <= 2.0.25 - Missing Authorization to Unauthenticated Tracking Status Update	Nov 18, 2025 10mo ago
CVE-2025-12955	high	7.5/10	Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure	Nov 18, 2025 10mo ago
CVE-2025-4212	high	7.2/10	Checkout Files Upload for WooCommerce <= 2.2.1 - Unauthenticated Stored Cross-Site Scripting	Nov 18, 2025 10mo ago
CVE-2025-13088	high	8.8/10	Category and Product Woocommerce Tabs <= 1.0 - Authenticated (Contributor+) Local File Inclusion	Nov 18, 2025 10mo ago
CVE-2025-12411	high	7.1/10	Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Authenticated (Subscriber+) SQL Injection	Nov 18, 2025 10mo ago
CVE-2025-64382	medium	4.3/10	WordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerability	Nov 13, 2025 10mo ago
CVE-2025-64380	medium	6.5/10	WordPress Booster for WooCommerce plugin <= 7.3.2 - Cross Site Scripting (XSS) vulnerability	Nov 13, 2025 10mo ago
CVE-2025-64379	medium	4.3/10	WordPress Booster for WooCommerce plugin <= 7.4.0 - Broken Access Control vulnerability	Nov 13, 2025 10mo ago
CVE-2025-64269	medium	4.3/10	WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.150 - Broken Access Control vulnerability	Nov 13, 2025 10mo ago
CVE-2025-64267	medium	4.3/10	WordPress WooCommerce Ultimate Points And Rewards plugin <= 2.10.2 - Sensitive Data Exposure vulnerability	Nov 13, 2025 10mo ago
CVE-2025-12903	high	7.5/10	Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud	Nov 12, 2025 10mo ago
CVE-2025-12087	medium	4.3/10	Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion	Nov 12, 2025 10mo ago
CVE-2025-12788	medium	5.3/10	Hydra Booking – All in One Appointment Booking System \| Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass	Nov 11, 2025 10mo ago
CVE-2025-12787	medium	5.3/10	Hydra Booking – All in One Appointment Booking System \| Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation	Nov 11, 2025 10mo ago
CVE-2025-11237	—	—	Make Email Customizer for WooCommerce <= 1.0.6 - Subscriber+ Arbitrary Options Update	Nov 11, 2025 10mo ago
CVE-2025-11821	medium	6.4/10	Woocommerce – Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Nov 11, 2025 10mo ago
CVE-2025-12588	medium	4.3/10	USB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update	Nov 11, 2025 10mo ago
CVE-2025-12621	medium	5.3/10	Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update	Nov 8, 2025 10mo ago
CVE-2025-64196	high	7.1/10	WordPress Booster for WooCommerce plugin <= 7.2.5 - Cross Site Scripting (XSS) vulnerability	Nov 6, 2025 10mo ago
CVE-2025-60248	high	7.5/10	WordPress WPC Product Options for WooCommerce plugin <= 3.1.3 - Local File Inclusion vulnerability	Nov 6, 2025 10mo ago