Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

339,782

All time

Critical · Active

10,860

CVSS ≥ 9.0

New · 14 days

2,591

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 511–540 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-47569	critical	9.3/10	WordPress WooCommerce Ultimate Gift Card plugin <= 2.9.6 - SQL Injection vulnerability	Sep 9, 2025 10mo ago
CVE-2025-47570	high	7.1/10	WordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerability	Sep 9, 2025 10mo ago
CVE-2025-10046	medium	4.9/10	ELEX WooCommerce Google Shopping (Google Product Feed) <= 1.4.3 - Authenticated (Admin+) SQL Inejction	Sep 6, 2025 10mo ago
CVE-2025-48317	high	7.5/10	WordPress WooCommerce Payment Gateway for Saferpay Plugin <= 0.4.9 - Path Traversal Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58878	medium	6.5/10	WordPress Woocommerce Gifts Product Plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58856	medium	6.5/10	WordPress Woocommerce Notify Updated Product Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58804	medium	4.3/10	WordPress WooCommerce Single Page Checkout Plugin <= 1.2.7 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58802	medium	4.3/10	WordPress TrustMate.io – WooCommerce integration plugin <= 1.16.0 - Cross Site Request Forgery (CSRF) vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58799	medium	4.3/10	WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58788	high	7.6/10	WordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection Vulnerability	Sep 5, 2025 10mo ago
CVE-2025-58599	medium	4.3/10	WordPress Order Delivery Date for WooCommerce Plugin <= 4.1.0 - Broken Access Control Vulnerability	Sep 3, 2025 10mo ago
CVE-2025-58598	medium	6.6/10	WordPress Klarna Order Management for WooCommerce Plugin <= 1.9.8 - Sensitive Data Exposure Vulnerability	Sep 3, 2025 10mo ago
CVE-2024-13342	high	8.1/10	Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload	Aug 29, 2025 10mo ago
CVE-2025-54029	high	7.7/10	WordPress WooCommerce csv import export Plugin <= 2.0.6 - Arbitrary File Deletion Vulnerability	Aug 28, 2025 10mo ago
CVE-2025-48358	medium	5.9/10	WordPress Risk Free Cash On Delivery (COD) – WooCommerce plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability	Aug 28, 2025 10mo ago
CVE-2025-6255	medium	6.4/10	Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter	Aug 28, 2025 10mo ago
CVE-2025-8073	medium	6.4/10	Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter	Aug 28, 2025 10mo ago
CVE-2025-7827	medium	4.3/10	Ni WooCommerce Customer Product Report <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update	Aug 23, 2025 11mo ago
CVE-2025-48148	critical	10.0/10	WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability	Aug 20, 2025 11mo ago
CVE-2025-53213	critical	9.9/10	WordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Arbitrary File Upload Vulnerability	Aug 20, 2025 11mo ago
CVE-2025-54713	critical	9.8/10	WordPress Taxi Booking Manager for WooCommerce plugin <= 1.3.0 - Broken Authentication vulnerability	Aug 20, 2025 11mo ago
CVE-2025-8618	medium	6.4/10	WPC Smart Quick View for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode	Aug 20, 2025 11mo ago
CVE-2025-7496	medium	6.4/10	WPC Smart Compare for WooCommerce <= 6.4.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Aug 19, 2025 11mo ago
CVE-2025-8898	critical	9.8/10	Taxi Booking Manager for Woocommerce \| E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover	Aug 16, 2025 11mo ago
CVE-2024-8393	medium	6.6/10	Woocommerce Blocks – Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion	Aug 16, 2025 11mo ago
CVE-2025-8342	high	8.1/10	WooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication Bypass	Aug 15, 2025 11mo ago
CVE-2025-6025	high	7.5/10	Order Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts	Aug 15, 2025 11mo ago
CVE-2025-53575	high	7.1/10	WordPress Primer MyData for Woocommerce Plugin <= 4.2.5 - Cross Site Request Forgery (CSRF) Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-54697	high	7.2/10	WordPress Kadence WooCommerce Email Designer Plugin <= 1.5.16 - Privilege Escalation Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-54692	high	7.5/10	WordPress Membership For WooCommerce Plugin <= 2.9.0 - Broken Access Control Vulnerability	Aug 14, 2025 11mo ago