Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

353,917

All time

Critical · Active

12,548

CVSS ≥ 9.0

New · 14 days

1,494

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-6176	high	7.2/10	Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form	Aug 28, 2026 1mo ago
CVE-2026-81277	high	8.5/10	WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability	Aug 27, 2026 1mo ago
CVE-2026-78283	high	7.1/10	WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability	Aug 27, 2026 1mo ago
CVE-2026-27330	high	8.6/10	WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability	Aug 27, 2026 1mo ago
CVE-2026-78137	—	—	StoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart	Aug 27, 2026 1mo ago
CVE-2026-18884	high	7.5/10	WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters	Aug 26, 2026 1mo ago
CVE-2026-32558	critical	9.8/10	WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability	Aug 24, 2026 1mo ago
CVE-2026-32477	high	8.6/10	WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability	Aug 24, 2026 1mo ago
CVE-2026-28171	high	8.6/10	WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability	Aug 24, 2026 1mo ago
CVE-2026-14853	—	—	WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization	Aug 23, 2026 1mo ago
CVE-2026-18027	medium	6.5/10	WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter	Aug 22, 2026 1mo ago
CVE-2026-66611	high	7.1/10	WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability	Aug 20, 2026 1mo ago
CVE-2026-74009	medium	5.3/10	WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73398	medium	6.5/10	WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73396	high	7.1/10	WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability	Aug 18, 2026 1mo ago
CVE-2026-73353	medium	5.3/10	WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-73346	high	7.6/10	WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66697	high	7.1/10	WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66655	high	7.1/10	WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66468	high	7.1/10	WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66466	high	7.5/10	WordPress StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66462	high	7.5/10	WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66461	high	7.5/10	WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66436	critical	9.3/10	WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability	Aug 13, 2026 1mo ago
CVE-2026-66431	high	7.5/10	WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-27345	high	7.5/10	WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability	Aug 13, 2026 1mo ago
CVE-2026-18391	—	—	WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection	Aug 12, 2026 1mo ago
CVE-2026-16538	—	—	TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up	Aug 12, 2026 1mo ago
CVE-2026-15039	—	—	Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload	Aug 12, 2026 1mo ago
CVE-2026-15211	medium	5.9/10	Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token	Aug 7, 2026 2mo ago