Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

339,805

All time

Critical · Active

10,860

CVSS ≥ 9.0

New · 14 days

2,581

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 541–570 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-54675	medium	4.3/10	WordPress YITH WooCommerce Popup Plugin plugin <= 1.48.0 - Cross Site Request Forgery (CSRF) Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-54674	medium	5.4/10	WordPress Product Configurator for WooCommerce Plugin plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-28999	high	7.1/10	WordPress WooCommerce Shop Page Builder <= 2.27.7 - Cross Site Scripting (XSS) Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-30993	medium	6.5/10	WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.7 - Broken Access Control Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-47610	medium	6.5/10	WordPress WooCommerce Fortnox Integration <= 4.5.6 - Cross Site Scripting (XSS) Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-49887	critical	9.9/10	WordPress Product XML Feed Manager for WooCommerce Plugin <= 2.9.3 - Remote Code Execution (RCE) Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-52820	high	8.5/10	WordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection Vulnerability	Aug 14, 2025 11mo ago
CVE-2025-5391	high	8.1/10	WooCommerce Purchase Orders <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion	Aug 12, 2025 11mo ago
CVE-2025-7646	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting	Aug 1, 2025 11mo ago
CVE-2025-5720	medium	6.4/10	Customer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via `author` Parameter	Jul 31, 2025 11mo ago
CVE-2025-6730	medium	4.3/10	Bonanza – WooCommerce Free Gifts Lite <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In Success	Jul 29, 2025 11mo ago
CVE-2025-8097	medium	5.3/10	WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation	Jul 26, 2025 11mo ago
CVE-2025-6717	medium	6.5/10	B1.lt for WooCommerce <= 2.2.56 - Authenticated (Subscriber+) SQL Injection	Jul 18, 2025 1y ago
CVE-2025-5767	medium	6.4/10	Crowdfunding for WooCommerce <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter	Jul 18, 2025 1y ago
CVE-2025-6718	high	8.8/10	B1.lt for WooCommerce <= 2.2.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection	Jul 18, 2025 1y ago
CVE-2025-6222	critical	9.8/10	WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet <= 3.2.6 - Unauthenticated Arbitrary File Upload	Jul 18, 2025 1y ago
CVE-2025-5816	medium	4.3/10	Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship <= 3.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) View Order Tracking Details	Jul 18, 2025 1y ago
CVE-2025-28955	high	7.5/10	WordPress Easy Video Player Wordpress & WooCommerce plugin <= 10.0 - Arbitrary File Download Vulnerability	Jul 16, 2025 1y ago
CVE-2025-29009	critical	10.0/10	WordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload Vulnerability	Jul 16, 2025 1y ago
CVE-2025-30959	medium	6.5/10	WordPress Product XML Feed Manager for WooCommerce <= 2.9.2 - Broken Access Control Vulnerability	Jul 16, 2025 1y ago
CVE-2025-47645	high	8.5/10	WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.4.9 - Subscriber+ SQL Injection vulnerability	Jul 16, 2025 1y ago
CVE-2025-49319	medium	6.5/10	WordPress Wishlist for WooCommerce <= 3.2.3 - Broken Access Control Vulnerability	Jul 16, 2025 1y ago
CVE-2025-49888	high	7.1/10	WordPress PW WooCommerce On Sale! plugin <= 1.39 - Broken Access Control Vulnerability	Jul 16, 2025 1y ago
CVE-2025-54041	medium	4.3/10	WordPress Wallet System for WooCommerce plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) Vulnerability	Jul 16, 2025 1y ago
CVE-2025-54030	medium	4.3/10	WordPress WooCommerce Google Sheet Connector plugin <= 1.3.20 - Cross Site Request Forgery (CSRF) Vulnerability	Jul 16, 2025 1y ago
CVE-2025-7359	high	8.2/10	Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block	Jul 16, 2025 1y ago
CVE-2025-5530	medium	6.4/10	WPC Smart Compare for WooCommerce <= 6.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jul 11, 2025 1y ago
CVE-2025-2942	—	—	Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure	Jul 11, 2025 1y ago
CVE-2025-3780	medium	6.5/10	WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification	Jul 8, 2025 1y ago
CVE-2025-24780	high	8.5/10	WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection Vulnerability	Jul 4, 2025 1y ago