Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,464

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,092

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 691–720 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-48122	critical	9.3/10	WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - SQL Injection Vulnerability	Jun 9, 2025 1y ago
CVE-2025-48124	high	7.5/10	WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Arbitrary File Download Vulnerability	Jun 9, 2025 1y ago
CVE-2025-48123	critical	10.0/10	WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Remote Code Execution (RCE) Vulnerability	Jun 9, 2025 1y ago
CVE-2025-48129	critical	9.8/10	WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Privilege Escalation Vulnerability	Jun 9, 2025 1y ago
CVE-2025-49265	high	7.5/10	WordPress Membership For WooCommerce plugin <= 2.8.1 - Broken Access Control Vulnerability	Jun 9, 2025 1y ago
CVE-2025-24762	medium	5.4/10	WordPress TicketBAI Facturas para WooCommerce plugin <= 3.45 - Broken Access Control vulnerability	Jun 6, 2025 1y ago
CVE-2025-28984	medium	4.3/10	WordPress Subscription Renewal Reminders for WooCommerce plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability	Jun 6, 2025 1y ago
CVE-2025-29006	medium	5.3/10	WordPress Direct Checkout for WooCommerce Lite plugin <= 1.0.3 - Broken Access Control Vulnerability	Jun 6, 2025 1y ago
CVE-2025-30950	medium	6.5/10	WordPress All Currencies for WooCommerce plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability	Jun 6, 2025 1y ago
CVE-2025-31000	medium	5.3/10	WordPress Payment QR WooCommerce plugin <= 1.1.6 - Broken Access Control Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49320	medium	5.3/10	WordPress FraudLabs Pro for WooCommerce plugin <= 2.22.11 - Broken Access Control Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49315	high	7.6/10	WordPress Persian Woocommerce SMS plugin <= 7.0.10 - SQL Injection Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49287	medium	4.3/10	WordPress Product Feed for WooCommerce plugin <= 2.2.8 - Broken Access Control Vulnerability	Jun 6, 2025 1y ago
CVE-2025-49239	medium	5.4/10	WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.5.0 - Cross Site Request Forgery (CSRF) Vulnerability	Jun 6, 2025 1y ago
CVE-2025-5103	medium	4.9/10	Ultimate Gift Cards for WooCommerce <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Function	Jun 3, 2025 1y ago
CVE-2025-5292	medium	6.4/10	Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	May 31, 2025 1y ago
CVE-2025-5285	medium	6.4/10	Product Subtitle for WooCommerce <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameter	May 31, 2025 1y ago
CVE-2025-48331	high	7.5/10	WordPress WooCommerce Orders & Customers Exporter <= 5.0 - Sensitive Data Exposure Vulnerability	May 30, 2025 1y ago
CVE-2025-4597	medium	6.5/10	Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion	May 30, 2025 1y ago
CVE-2025-5058	critical	9.8/10	eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()	May 24, 2025 1y ago
CVE-2025-4603	critical	9.1/10	eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletion	May 24, 2025 1y ago
CVE-2025-4336	high	8.1/10	eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()	May 24, 2025 1y ago
CVE-2025-4602	medium	5.9/10	eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Read	May 24, 2025 1y ago
CVE-2025-31397	critical	9.3/10	WordPress Bus Ticket Booking with Seat Reservation for WooCommerce plugin <= 1.7 - SQL Injection vulnerability	May 23, 2025 1y ago
CVE-2025-47461	high	8.8/10	WordPress Subaccounts for WooCommerce plugin <= 1.6.6 - Account Takeover vulnerability	May 23, 2025 1y ago
CVE-2025-47532	critical	9.8/10	WordPress CoinPayments.net Payment Gateway for WooCommerce plugin <= 1.0.17 - PHP Object Injection Vulnerability	May 23, 2025 1y ago
CVE-2025-47641	critical	10.0/10	WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.3.9 - Arbitrary File Upload Vulnerability	May 23, 2025 1y ago
CVE-2025-47640	critical	9.3/10	WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection Vulnerability	May 23, 2025 1y ago
CVE-2025-47687	critical	10.0/10	WordPress StoreKeeper for WooCommerce plugin <= 14.4.4 - Arbitrary File Upload Vulnerability	May 23, 2025 1y ago
CVE-2025-5062	medium	6.1/10	WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting	May 22, 2025 1y ago