Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

339,981

All time

Critical · Active

10,875

CVSS ≥ 9.0

New · 14 days

2,607

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 571–600 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-50032	medium	6.5/10	WordPress Paytiko for WooCommerce plugin <= 1.3.21 - Broken Access Control vulnerability	Jul 4, 2025 1y ago
CVE-2025-49417	critical	9.8/10	WordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data Vulnerability	Jul 4, 2025 1y ago
CVE-2025-29001	medium	4.3/10	WordPress WooCommerce Shop Page Builder plugin <= 2.27.7 - Broken Access Control Vulnerability	Jul 4, 2025 1y ago
CVE-2025-53569	medium	4.3/10	WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) Vulnerability	Jul 4, 2025 1y ago
CVE-2025-6729	medium	6.4/10	PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery	Jul 4, 2025 1y ago
CVE-2025-39362	medium	6.5/10	WordPress Mollie Payments for WooCommerce plugin <= 8.0.2 - Insecure Direct Object References (IDOR) vulnerability	Jul 2, 2025 1y ago
CVE-2025-5817	high	7.2/10	Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery	Jul 2, 2025 1y ago
CVE-2025-5746	critical	9.8/10	Drag and Drop Multiple File Upload (Pro) - WooCommerce <= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload	Jul 2, 2025 1y ago
CVE-2025-53281	high	7.5/10	WordPress WPB Category Slider for WooCommerce plugin <= 1.71 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-53271	high	7.1/10	WordPress Additional Order Filters for WooCommerce plugin <= 1.22 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability	Jun 27, 2025 1y ago
CVE-2025-53203	medium	4.3/10	WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.148 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 27, 2025 1y ago
CVE-2025-24774	high	7.1/10	WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 27, 2025 1y ago
CVE-2025-28947	high	8.1/10	WordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-30972	high	7.1/10	WordPress Woocommerce Line Notify plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability	Jun 27, 2025 1y ago
CVE-2025-49885	critical	10.0/10	WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload Vulnerability	Jun 27, 2025 1y ago
CVE-2023-25998	high	8.1/10	WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-23973	high	7.1/10	WordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerability	Jun 27, 2025 1y ago
CVE-2025-23967	critical	9.3/10	WordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerability	Jun 27, 2025 1y ago
CVE-2025-5813	medium	5.3/10	Amazon Products to WooCommerce <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation	Jun 26, 2025 1y ago
CVE-2025-49998	medium	5.4/10	WordPress WooCommerce Fortnox Integration plugin <= 4.5.5 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago
CVE-2025-50008	medium	5.4/10	WordPress WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin <= 1.2.4.5 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago
CVE-2025-50045	medium	6.5/10	WordPress Related Products Manager for WooCommerce plugin <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-52783	high	7.1/10	WordPress Change Cart button Colors WooCommerce plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-6201	medium	6.4/10	Pixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode	Jun 19, 2025 1y ago
CVE-2025-1562	critical	9.8/10	Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation	Jun 18, 2025 1y ago
CVE-2025-48111	medium	4.3/10	WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability	Jun 17, 2025 1y ago
CVE-2025-24773	critical	9.3/10	WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - SQL Injection Vulnerability	Jun 17, 2025 1y ago
CVE-2025-30618	critical	9.8/10	WordPress Rapyd Payment Extension for WooCommerce plugin <= 1.2.0 - PHP Object Injection Vulnerability	Jun 17, 2025 1y ago
CVE-2025-48118	high	8.5/10	WordPress Woocommerce Partial Shipment plugin <= 3.2 - SQL Injection Vulnerability	Jun 17, 2025 1y ago
CVE-2025-5238	medium	6.4/10	YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	Jun 14, 2025 1y ago