Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,137

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,111

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-73353	medium	5.3/10	WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-73346	high	7.6/10	WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66697	high	7.1/10	WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66655	high	7.1/10	WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66468	high	7.1/10	WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66466	high	7.5/10	WordPress StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66462	high	7.5/10	WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66461	high	7.5/10	WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66436	critical	9.3/10	WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66431	high	7.5/10	WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-27345	high	7.5/10	WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-18391	—	—	WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection	Aug 12, 2026 1mo ago
CVE-2026-16538	—	—	TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up	Aug 12, 2026 1mo ago
CVE-2026-15039	—	—	Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload	Aug 12, 2026 1mo ago
CVE-2026-15211	medium	5.9/10	Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token	Aug 7, 2026 1mo ago
CVE-2026-16620	high	7.5/10	WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode	Aug 6, 2026 1mo ago
CVE-2026-16067	medium	5.3/10	Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price	Aug 6, 2026 1mo ago
CVE-2026-13399	high	7.5/10	Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order	Aug 6, 2026 1mo ago
CVE-2026-12584	high	7.5/10	Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback	Aug 6, 2026 1mo ago
CVE-2026-10599	high	7.5/10	Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse	Aug 6, 2026 1mo ago
CVE-2026-66711	high	7.1/10	WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 1mo ago
CVE-2026-65559	high	7.2/10	WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability	Aug 6, 2026 1mo ago
CVE-2026-28180	medium	5.3/10	WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability	Aug 6, 2026 1mo ago
CVE-2026-28169	medium	5.3/10	WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability	Aug 6, 2026 1mo ago
CVE-2026-28005	critical	9.8/10	WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability	Aug 6, 2026 1mo ago
CVE-2026-13153	—	—	Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint	Aug 6, 2026 1mo ago
CVE-2026-16054	—	—	Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle	Aug 6, 2026 1mo ago
CVE-2026-16981	—	—	DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR	Aug 5, 2026 1mo ago
CVE-2026-16940	—	—	Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal	Aug 5, 2026 1mo ago
CVE-2026-11421	medium	6.5/10	ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter	Aug 5, 2026 1mo ago