Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,026

All time

Critical · Active

10,879

CVSS ≥ 9.0

New · 14 days

2,593

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 601–630 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-4200	high	8.1/10	Zagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion	Jun 14, 2025 1y ago
CVE-2025-49510	medium	4.3/10	WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability	Jun 10, 2025 1y ago
CVE-2025-4387	high	8.8/10	Abandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload	Jun 10, 2025 1y ago
CVE-2023-25999	high	8.1/10	WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-24767	critical	9.3/10	WordPress TicketBAI Facturas para WooCommerce plugin <= 3.19 - SQL Injection Vulnerability	Jun 9, 2025 1y ago
CVE-2025-28945	high	8.1/10	WordPress Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-47463	high	7.1/10	WordPress Stock Locations for WooCommerce plugin <= 2.8.6 - Broken Access Control Vulnerability	Jun 9, 2025 1y ago
CVE-2025-47487	high	7.1/10	WordPress MC Woocommerce Wishlist plugin <= 1.9.1 - Cross Site Scripting (XSS) Vulnerability	Jun 9, 2025 1y ago
CVE-2025-47608	critical	9.3/10	WordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability	Jun 9, 2025 1y ago
CVE-2025-48122	critical	9.3/10	WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - SQL Injection Vulnerability	Jun 9, 2025 1y ago
CVE-2025-48124	high	7.5/10	WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Arbitrary File Download Vulnerability	Jun 9, 2025 1y ago
CVE-2025-48123	critical	10.0/10	WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Remote Code Execution (RCE) Vulnerability	Jun 9, 2025 1y ago
CVE-2025-48129	critical	9.8/10	WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Privilege Escalation Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49265	high	7.5/10	WordPress Membership For WooCommerce plugin <= 2.8.1 - Broken Access Control Vulnerability	Jun 9, 2025 1y ago
CVE-2025-24762	medium	5.4/10	WordPress TicketBAI Facturas para WooCommerce plugin <= 3.45 - Broken Access Control vulnerability	Jun 6, 2025 1y ago
CVE-2025-28984	medium	4.3/10	WordPress Subscription Renewal Reminders for WooCommerce plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability	Jun 6, 2025 1y ago
CVE-2025-29006	medium	5.3/10	WordPress Direct Checkout for WooCommerce Lite plugin <= 1.0.3 - Broken Access Control Vulnerability	Jun 6, 2025 1y ago
CVE-2025-30950	medium	6.5/10	WordPress All Currencies for WooCommerce plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability	Jun 6, 2025 1y ago
CVE-2025-31000	medium	5.3/10	WordPress Payment QR WooCommerce plugin <= 1.1.6 - Broken Access Control Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49320	medium	5.3/10	WordPress FraudLabs Pro for WooCommerce plugin <= 2.22.11 - Broken Access Control Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49315	high	7.6/10	WordPress Persian Woocommerce SMS plugin <= 7.0.10 - SQL Injection Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49287	medium	4.3/10	WordPress Product Feed for WooCommerce plugin <= 2.2.8 - Broken Access Control Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49239	medium	5.4/10	WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.5.0 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-5103	medium	4.9/10	Ultimate Gift Cards for WooCommerce <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Function	Jun 3, 2025 1y ago
CVE-2025-5292	medium	6.4/10	Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	May 31, 2025 1y ago
CVE-2025-5285	medium	6.4/10	Product Subtitle for WooCommerce <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameter	May 31, 2025 1y ago
CVE-2025-48331	high	7.5/10	WordPress WooCommerce Orders & Customers Exporter <= 5.0 - Sensitive Data Exposure Vulnerability	May 30, 2025 1y ago
CVE-2025-4597	medium	6.5/10	Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion	May 30, 2025 1y ago
CVE-2025-5058	critical	9.8/10	eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()	May 24, 2025 1y ago
CVE-2025-4603	critical	9.1/10	eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletion	May 24, 2025 1y ago