Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,463

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,093

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 541–570 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-53422	high	7.1/10	WordPress WhatsApp Chat for WordPress and WooCommerce plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability	Oct 22, 2025 10mo ago
CVE-2025-53297	high	7.1/10	WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability	Oct 22, 2025 10mo ago
CVE-2025-52757	medium	6.5/10	WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Arbitrary Content Deletion vulnerability	Oct 22, 2025 10mo ago
CVE-2025-49958	high	7.1/10	WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability	Oct 22, 2025 10mo ago
CVE-2025-49947	high	7.1/10	WordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability	Oct 22, 2025 10mo ago
CVE-2025-49911	high	7.1/10	WordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - Cross Site Scripting (XSS) vulnerability	Oct 22, 2025 10mo ago
CVE-2025-49908	medium	6.5/10	WordPress WPC Countdown Timer for WooCommerce plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability	Oct 22, 2025 10mo ago
CVE-2025-49380	critical	9.8/10	WordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - PHP Object Injection vulnerability	Oct 22, 2025 10mo ago
CVE-2025-10570	medium	4.3/10	Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund	Oct 22, 2025 10mo ago
CVE-2025-11691	high	7.5/10	PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection	Oct 18, 2025 10mo ago
CVE-2025-11391	critical	9.8/10	PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload	Oct 18, 2025 10mo ago
CVE-2025-11741	medium	5.3/10	WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure	Oct 18, 2025 10mo ago
CVE-2025-11742	medium	4.3/10	WPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure	Oct 18, 2025 10mo ago
CVE-2025-11746	high	8.8/10	XStore \| Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion	Oct 15, 2025 10mo ago
CVE-2025-6439	critical	9.8/10	WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion	Oct 11, 2025 10mo ago
CVE-2025-10167	medium	6.4/10	Stock History & Reports Manager for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Oct 11, 2025 10mo ago
CVE-2025-11518	medium	5.3/10	WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation	Oct 11, 2025 10mo ago
CVE-2025-10862	high	7.5/10	Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'	Oct 9, 2025 10mo ago
CVE-2025-9286	critical	9.8/10	Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password	Oct 3, 2025 11mo ago
CVE-2025-10191	medium	6.4/10	Big Post Shipping for WooCommerce <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Sep 30, 2025 11mo ago
CVE-2025-60219	critical	10.0/10	WordPress WooCommerce Designer Pro Plugin <= 1.9.24 - Arbitrary File Upload Vulnerability	Sep 26, 2025 11mo ago
CVE-2025-60173	high	7.1/10	WordPress GST for WooCommerce Plugin <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 26, 2025 11mo ago
CVE-2025-60171	high	7.1/10	WordPress Conditional Cart Messages for WooCommerce – YourPlugins.com Plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) Vulnerability	Sep 26, 2025 11mo ago
CVE-2025-60159	medium	4.3/10	WordPress Nota Fiscal Eletrônica WooCommerce plugin <= 3.4.0.9 - Broken Access Control vulnerability	Sep 26, 2025 11mo ago
CVE-2025-60158	medium	5.9/10	WordPress Nota Fiscal Eletrônica WooCommerce plugin <= 3.4.0.9 - Cross Site Scripting (XSS) vulnerability	Sep 26, 2025 11mo ago
CVE-2025-58917	medium	6.5/10	WordPress Quantities and Units for WooCommerce plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability	Sep 26, 2025 11mo ago
CVE-2025-10173	low	2.7/10	ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update	Sep 26, 2025 11mo ago
CVE-2025-9054	critical	9.8/10	MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'	Sep 24, 2025 11mo ago
CVE-2025-10412	critical	9.8/10	Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.55 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file'	Sep 23, 2025 11mo ago
CVE-2025-59559	medium	4.3/10	WordPress Payrexx Payment Gateway for WooCommerce Plugin <= 3.1.5 - Broken Access Control Vulnerability	Sep 22, 2025 11mo ago