Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

357,894

All time

Critical · Active

12,864

CVSS ≥ 9.0

New · 14 days

929

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-105421	medium	5.3/10	WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability	Oct 5, 2026 29d ago
CVE-2026-104118	—	—	Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR	Oct 4, 2026 1mo ago
CVE-2026-104313	medium	6.1/10	WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter	Oct 3, 2026 1mo ago
CVE-2026-97660	high	7.2/10	WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name	Oct 3, 2026 1mo ago
CVE-2026-92437	—	—	Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion	Oct 3, 2026 1mo ago
CVE-2026-103888	medium	6.1/10	WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter	Oct 3, 2026 1mo ago
CVE-2026-101923	high	8.1/10	Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter	Oct 3, 2026 1mo ago
CVE-2026-11399	medium	4.3/10	Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter	Oct 3, 2026 1mo ago
CVE-2026-97663	high	7.2/10	Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name	Oct 2, 2026 1mo ago
CVE-2026-84925	medium	6.1/10	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter	Oct 2, 2026 1mo ago
CVE-2026-97273	high	7.1/10	WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability	Oct 1, 2026 1mo ago
CVE-2026-95687	high	8.8/10	WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint	Oct 1, 2026 1mo ago
CVE-2026-12241	medium	5.4/10	Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting	Oct 1, 2026 1mo ago
CVE-2026-18143	critical	9.8/10	Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler	Sep 26, 2026 1mo ago
CVE-2026-93836	high	7.2/10	WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter	Sep 22, 2026 1mo ago
CVE-2026-9766	medium	4.3/10	Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action	Sep 19, 2026 1mo ago
CVE-2026-75959	medium	4.9/10	GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter	Sep 19, 2026 1mo ago
CVE-2026-12402	medium	4.4/10	OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting	Sep 19, 2026 1mo ago
CVE-2026-9832	medium	5.3/10	Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint	Sep 19, 2026 1mo ago
CVE-2026-11899	medium	4.3/10	PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler	Sep 19, 2026 1mo ago
CVE-2026-84025	—	—	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR	Sep 12, 2026 1mo ago
CVE-2026-84024	—	—	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF	Sep 12, 2026 1mo ago
CVE-2026-84023	—	—	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF	Sep 12, 2026 1mo ago
CVE-2026-81789	high	8.6/10	WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability	Sep 10, 2026 1mo ago
CVE-2026-8615	medium	4.3/10	ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function	Sep 9, 2026 1mo ago
CVE-2026-76009	high	8.1/10	Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint	Sep 9, 2026 1mo ago
CVE-2026-81792	medium	6.5/10	WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability	Sep 8, 2026 1mo ago
CVE-2026-81543	high	8.8/10	Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	Sep 5, 2026 2mo ago
CVE-2026-84849	medium	6.5/10	WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability	Sep 3, 2026 2mo ago
CVE-2026-81280	medium	6.5/10	WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability	Aug 31, 2026 2mo ago