Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,226

All time

Critical · Active

12,441

CVSS ≥ 9.0

New · 14 days

2,142

Newly disclosed

Feed last synced

57 mins ago

Data freshness

Showing 661–690 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-7359	high	8.2/10	Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block	Jul 16, 2025 1y ago
CVE-2025-5530	medium	6.4/10	WPC Smart Compare for WooCommerce <= 6.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jul 11, 2025 1y ago
CVE-2025-2942	—	—	Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure	Jul 11, 2025 1y ago
CVE-2025-3780	medium	6.5/10	WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification	Jul 8, 2025 1y ago
CVE-2025-24780	high	8.5/10	WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection Vulnerability	Jul 4, 2025 1y ago
CVE-2025-50032	medium	6.5/10	WordPress Paytiko for WooCommerce plugin <= 1.3.21 - Broken Access Control vulnerability	Jul 4, 2025 1y ago
CVE-2025-49417	critical	9.8/10	WordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data Vulnerability	Jul 4, 2025 1y ago
CVE-2025-29001	medium	4.3/10	WordPress WooCommerce Shop Page Builder plugin <= 2.27.7 - Broken Access Control Vulnerability	Jul 4, 2025 1y ago
CVE-2025-53569	medium	4.3/10	WordPress Trust Payments Gateway for WooCommerce (JavaScript Library) plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) Vulnerability	Jul 4, 2025 1y ago
CVE-2025-6729	medium	6.4/10	PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery	Jul 4, 2025 1y ago
CVE-2025-39362	medium	6.5/10	WordPress Mollie Payments for WooCommerce plugin <= 8.0.2 - Insecure Direct Object References (IDOR) vulnerability	Jul 2, 2025 1y ago
CVE-2025-5817	high	7.2/10	Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery	Jul 2, 2025 1y ago
CVE-2025-5746	critical	9.8/10	Drag and Drop Multiple File Upload (Pro) - WooCommerce <= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload	Jul 2, 2025 1y ago
CVE-2025-53281	high	7.5/10	WordPress WPB Category Slider for WooCommerce plugin <= 1.71 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-53271	high	7.1/10	WordPress Additional Order Filters for WooCommerce plugin <= 1.22 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability	Jun 27, 2025 1y ago
CVE-2025-53203	medium	4.3/10	WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.148 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 27, 2025 1y ago
CVE-2025-24774	high	7.1/10	WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 27, 2025 1y ago
CVE-2025-28947	high	8.1/10	WordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-30972	high	7.1/10	WordPress Woocommerce Line Notify plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability	Jun 27, 2025 1y ago
CVE-2025-49885	critical	10.0/10	WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload Vulnerability	Jun 27, 2025 1y ago
CVE-2023-25998	high	8.1/10	WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability	Jun 27, 2025 1y ago
CVE-2025-23973	high	7.1/10	WordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerability	Jun 27, 2025 1y ago
CVE-2025-23967	critical	9.3/10	WordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerability	Jun 27, 2025 1y ago
CVE-2025-5813	medium	5.3/10	Amazon Products to WooCommerce <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation	Jun 26, 2025 1y ago
CVE-2025-49998	medium	5.4/10	WordPress WooCommerce Fortnox Integration plugin <= 4.5.5 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago
CVE-2025-50008	medium	5.4/10	WordPress WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin <= 1.2.4.5 - Broken Access Control Vulnerability	Jun 20, 2025 1y ago
CVE-2025-50045	medium	6.5/10	WordPress Related Products Manager for WooCommerce plugin <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-52783	high	7.1/10	WordPress Change Cart button Colors WooCommerce plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 20, 2025 1y ago
CVE-2025-6201	medium	6.4/10	Pixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode	Jun 19, 2025 1y ago
CVE-2025-1562	critical	9.8/10	Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation	Jun 18, 2025 1y ago