Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,463

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,093

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 601–630 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-58788	high	7.6/10	WordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection Vulnerability	Sep 5, 2025 11mo ago
CVE-2025-58599	medium	4.3/10	WordPress Order Delivery Date for WooCommerce Plugin <= 4.1.0 - Broken Access Control Vulnerability	Sep 3, 2025 12mo ago
CVE-2025-58598	medium	6.6/10	WordPress Klarna Order Management for WooCommerce Plugin <= 1.9.8 - Sensitive Data Exposure Vulnerability	Sep 3, 2025 12mo ago
CVE-2024-13342	high	8.1/10	Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload	Aug 29, 2025 1y ago
CVE-2025-54029	high	7.7/10	WordPress WooCommerce csv import export Plugin <= 2.0.6 - Arbitrary File Deletion Vulnerability	Aug 28, 2025 1y ago
CVE-2025-48358	medium	5.9/10	WordPress Risk Free Cash On Delivery (COD) – WooCommerce plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability	Aug 28, 2025 1y ago
CVE-2025-6255	medium	6.4/10	Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter	Aug 28, 2025 1y ago
CVE-2025-8073	medium	6.4/10	Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter	Aug 28, 2025 1y ago
CVE-2025-7827	medium	4.3/10	Ni WooCommerce Customer Product Report <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update	Aug 23, 2025 1y ago
CVE-2025-48148	critical	10.0/10	WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability	Aug 20, 2025 1y ago
CVE-2025-53213	critical	9.9/10	WordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Arbitrary File Upload Vulnerability	Aug 20, 2025 1y ago
CVE-2025-54713	critical	9.8/10	WordPress Taxi Booking Manager for WooCommerce plugin <= 1.3.0 - Broken Authentication vulnerability	Aug 20, 2025 1y ago
CVE-2025-8618	medium	6.4/10	WPC Smart Quick View for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode	Aug 20, 2025 1y ago
CVE-2025-7496	medium	6.4/10	WPC Smart Compare for WooCommerce <= 6.4.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Aug 19, 2025 1y ago
CVE-2025-8898	critical	9.8/10	Taxi Booking Manager for Woocommerce \| E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover	Aug 16, 2025 1y ago
CVE-2024-8393	medium	6.6/10	Woocommerce Blocks – Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion	Aug 16, 2025 1y ago
CVE-2025-8342	high	8.1/10	WooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication Bypass	Aug 15, 2025 1y ago
CVE-2025-6025	high	7.5/10	Order Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts	Aug 15, 2025 1y ago
CVE-2025-53575	high	7.1/10	WordPress Primer MyData for Woocommerce Plugin <= 4.2.5 - Cross Site Request Forgery (CSRF) Vulnerability	Aug 14, 2025 1y ago
CVE-2025-54697	high	7.2/10	WordPress Kadence WooCommerce Email Designer Plugin <= 1.5.16 - Privilege Escalation Vulnerability	Aug 14, 2025 1y ago
CVE-2025-54692	high	7.5/10	WordPress Membership For WooCommerce Plugin <= 2.9.0 - Broken Access Control Vulnerability	Aug 14, 2025 1y ago
CVE-2025-54675	medium	4.3/10	WordPress YITH WooCommerce Popup Plugin plugin <= 1.48.0 - Cross Site Request Forgery (CSRF) Vulnerability	Aug 14, 2025 1y ago
CVE-2025-54674	medium	5.4/10	WordPress Product Configurator for WooCommerce Plugin plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability	Aug 14, 2025 1y ago
CVE-2025-28999	high	7.1/10	WordPress WooCommerce Shop Page Builder <= 2.27.7 - Cross Site Scripting (XSS) Vulnerability	Aug 14, 2025 1y ago
CVE-2025-30993	medium	6.5/10	WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.7 - Broken Access Control Vulnerability	Aug 14, 2025 1y ago
CVE-2025-47610	medium	6.5/10	WordPress WooCommerce Fortnox Integration <= 4.5.6 - Cross Site Scripting (XSS) Vulnerability	Aug 14, 2025 1y ago
CVE-2025-49887	critical	9.9/10	WordPress Product XML Feed Manager for WooCommerce Plugin <= 2.9.3 - Remote Code Execution (RCE) Vulnerability	Aug 14, 2025 1y ago
CVE-2025-52820	high	8.5/10	WordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection Vulnerability	Aug 14, 2025 1y ago
CVE-2025-5391	high	8.1/10	WooCommerce Purchase Orders <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion	Aug 12, 2025 1y ago
CVE-2025-7646	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting	Aug 1, 2025 1y ago