Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,462

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,095

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-15211	medium	5.9/10	Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token	Aug 7, 2026 23d ago
CVE-2026-16620	high	7.5/10	WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode	Aug 6, 2026 24d ago
CVE-2026-16067	medium	5.3/10	Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price	Aug 6, 2026 24d ago
CVE-2026-13399	high	7.5/10	Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order	Aug 6, 2026 24d ago
CVE-2026-12584	high	7.5/10	Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback	Aug 6, 2026 24d ago
CVE-2026-10599	high	7.5/10	Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse	Aug 6, 2026 24d ago
CVE-2026-66711	high	7.1/10	WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability	Aug 6, 2026 24d ago
CVE-2026-65559	high	7.2/10	WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability	Aug 6, 2026 24d ago
CVE-2026-28180	medium	5.3/10	WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability	Aug 6, 2026 24d ago
CVE-2026-28169	medium	5.3/10	WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability	Aug 6, 2026 24d ago
CVE-2026-28005	critical	9.8/10	WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability	Aug 6, 2026 24d ago
CVE-2026-13153	—	—	Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint	Aug 6, 2026 24d ago
CVE-2026-16054	—	—	Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle	Aug 6, 2026 24d ago
CVE-2026-16981	—	—	DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR	Aug 5, 2026 25d ago
CVE-2026-16940	—	—	Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal	Aug 5, 2026 25d ago
CVE-2026-11421	medium	6.5/10	ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter	Aug 5, 2026 25d ago
CVE-2026-16285	—	—	WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download	Aug 2, 2026 28d ago
CVE-2026-16063	—	—	Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content	Aug 2, 2026 28d ago
CVE-2026-16062	—	—	Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content	Aug 2, 2026 28d ago
CVE-2026-15206	—	—	SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile	Aug 2, 2026 28d ago
CVE-2026-8457	critical	9.8/10	WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT	Aug 1, 2026 29d ago
CVE-2025-14073	medium	5.3/10	WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure	Aug 1, 2026 29d ago
CVE-2026-15414	high	8.8/10	Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta	Aug 1, 2026 1mo ago
CVE-2026-15258	—	—	Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter	Jul 31, 2026 1mo ago
CVE-2026-15397	high	7.2/10	Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action	Jul 30, 2026 1mo ago
CVE-2026-11782	—	—	Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR	Jul 30, 2026 1mo ago
CVE-2026-14270	high	8.8/10	Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings	Jul 29, 2026 1mo ago
CVE-2026-7436	medium	6.4/10	WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute	Jul 29, 2026 1mo ago
CVE-2026-16597	high	7.2/10	GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields	Jul 29, 2026 1mo ago
CVE-2025-10656	critical	9.8/10	Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation	Jul 29, 2026 1mo ago