Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,464

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,092

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 661–690 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-53271	high	7.1/10	WordPress Additional Order Filters for WooCommerce plugin <= 1.22 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability	Jun 27, 2025 1y ago
CVE-2025-53203	medium	4.3/10	WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.148 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 27, 2025 1y ago
CVE-2025-24774	high	7.1/10	WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 27, 2025 1y ago
CVE-2025-28947	high	8.1/10	WordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-30972	high	7.1/10	WordPress Woocommerce Line Notify plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability	Jun 27, 2025 1y ago
CVE-2025-49885	critical	10.0/10	WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload Vulnerability	Jun 27, 2025 1y ago
CVE-2023-25998	high	8.1/10	WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-23973	high	7.1/10	WordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerability	Jun 27, 2025 1y ago
CVE-2025-23967	critical	9.3/10	WordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerability	Jun 27, 2025 1y ago
CVE-2025-5813	medium	5.3/10	Amazon Products to WooCommerce <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation	Jun 26, 2025 1y ago
CVE-2025-49998	medium	5.4/10	WordPress WooCommerce Fortnox Integration plugin <= 4.5.5 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago
CVE-2025-50008	medium	5.4/10	WordPress WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin <= 1.2.4.5 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago
CVE-2025-50045	medium	6.5/10	WordPress Related Products Manager for WooCommerce plugin <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-52783	high	7.1/10	WordPress Change Cart button Colors WooCommerce plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-6201	medium	6.4/10	Pixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode	Jun 19, 2025 1y ago
CVE-2025-1562	critical	9.8/10	Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation	Jun 18, 2025 1y ago
CVE-2025-48111	medium	4.3/10	WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability	Jun 17, 2025 1y ago
CVE-2025-24773	critical	9.3/10	WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - SQL Injection Vulnerability	Jun 17, 2025 1y ago
CVE-2025-30618	critical	9.8/10	WordPress Rapyd Payment Extension for WooCommerce plugin <= 1.2.0 - PHP Object Injection Vulnerability	Jun 17, 2025 1y ago
CVE-2025-48118	high	8.5/10	WordPress Woocommerce Partial Shipment plugin <= 3.2 - SQL Injection Vulnerability	Jun 17, 2025 1y ago
CVE-2025-5238	medium	6.4/10	YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	Jun 14, 2025 1y ago
CVE-2025-4200	high	8.1/10	Zagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion	Jun 14, 2025 1y ago
CVE-2025-49510	medium	4.3/10	WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability	Jun 10, 2025 1y ago
CVE-2025-4387	high	8.8/10	Abandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload	Jun 10, 2025 1y ago
CVE-2023-25999	high	8.1/10	WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-24767	critical	9.3/10	WordPress TicketBAI Facturas para WooCommerce plugin <= 3.19 - SQL Injection Vulnerability	Jun 9, 2025 1y ago
CVE-2025-28945	high	8.1/10	WordPress Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability	Jun 9, 2025 1y ago
CVE-2025-47463	high	7.1/10	WordPress Stock Locations for WooCommerce plugin <= 2.8.6 - Broken Access Control Vulnerability	Jun 9, 2025 1y ago
CVE-2025-47487	high	7.1/10	WordPress MC Woocommerce Wishlist plugin <= 1.9.1 - Cross Site Scripting (XSS) Vulnerability	Jun 9, 2025 1y ago
CVE-2025-47608	critical	9.3/10	WordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability	Jun 9, 2025 1y ago