Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

355,425

All time

Critical · Active

12,667

CVSS ≥ 9.0

New · 14 days

1,944

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-75959	medium	4.9/10	GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter	Sep 19, 2026 25d ago
CVE-2026-12402	medium	4.4/10	OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting	Sep 19, 2026 25d ago
CVE-2026-9832	medium	5.3/10	Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint	Sep 19, 2026 25d ago
CVE-2026-11899	medium	4.3/10	PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler	Sep 19, 2026 25d ago
CVE-2026-84025	—	—	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR	Sep 12, 2026 1mo ago
CVE-2026-84024	—	—	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF	Sep 12, 2026 1mo ago
CVE-2026-84023	—	—	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF	Sep 12, 2026 1mo ago
CVE-2026-81789	high	8.6/10	WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability	Sep 10, 2026 1mo ago
CVE-2026-8615	medium	4.3/10	ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function	Sep 9, 2026 1mo ago
CVE-2026-76009	high	8.1/10	Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint	Sep 9, 2026 1mo ago
CVE-2026-81792	medium	6.5/10	WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability	Sep 8, 2026 1mo ago
CVE-2026-81543	high	8.8/10	Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	Sep 5, 2026 1mo ago
CVE-2026-84849	medium	6.5/10	WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability	Sep 3, 2026 1mo ago
CVE-2026-81280	medium	6.5/10	WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability	Aug 31, 2026 1mo ago
CVE-2026-15369	critical	9.8/10	Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout	Aug 29, 2026 1mo ago
CVE-2026-6176	high	7.2/10	Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form	Aug 28, 2026 1mo ago
CVE-2026-81277	high	8.5/10	WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability	Aug 27, 2026 1mo ago
CVE-2026-78283	high	7.1/10	WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability	Aug 27, 2026 1mo ago
CVE-2026-27330	high	8.6/10	WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability	Aug 27, 2026 1mo ago
CVE-2026-78137	—	—	StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart	Aug 27, 2026 1mo ago
CVE-2026-18884	high	7.5/10	WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters	Aug 26, 2026 1mo ago
CVE-2026-32558	critical	9.8/10	WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability	Aug 24, 2026 1mo ago
CVE-2026-32477	high	8.6/10	WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability	Aug 24, 2026 1mo ago
CVE-2026-28171	high	8.6/10	WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability	Aug 24, 2026 1mo ago
CVE-2026-14853	—	—	WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization	Aug 23, 2026 1mo ago
CVE-2026-18027	medium	6.5/10	WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter	Aug 22, 2026 1mo ago
CVE-2026-66611	high	7.1/10	WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability	Aug 20, 2026 1mo ago
CVE-2026-74009	medium	5.3/10	WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73398	medium	6.5/10	WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73396	high	7.1/10	WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability	Aug 18, 2026 1mo ago