Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,464

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,092

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 721–750 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-2929	—	—	Order Delivery Date Pro for WooCommerce < 12.4.0 - Reflected XSS	May 20, 2025 1y ago
CVE-2025-39446	high	7.1/10	WordPress Booster Plus for WooCommerce plugin <= 7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability	May 19, 2025 1y ago
CVE-2025-43838	medium	6.5/10	WordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change Vulnerability	May 19, 2025 1y ago
CVE-2025-47577	critical	10.0/10	WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability	May 19, 2025 1y ago
CVE-2025-39364	high	7.5/10	WordPress Product Category Slider for WooCommerce plugin <= 4.3.4 - Local File Inclusion vulnerability	May 19, 2025 1y ago
CVE-2025-32920	medium	6.5/10	WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability	May 19, 2025 1y ago
CVE-2025-48342	medium	5.4/10	WordPress Dynamic Pricing & Discounts Lite for WooCommerce plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) vulnerability	May 19, 2025 1y ago
CVE-2025-48284	medium	5.4/10	WordPress Japanized For WooCommerce plugin <= 2.6.40 - Cross Site Request Forgery (CSRF) Vulnerability	May 19, 2025 1y ago
CVE-2025-48268	medium	4.3/10	WordPress Bot for Telegram on WooCommerce plugin <= 1.2.6 - Broken Access Control Vulnerability	May 19, 2025 1y ago
CVE-2025-48266	medium	6.5/10	WordPress Active Products Tables for WooCommerce plugin <= 1.0.6.8 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48265	medium	4.3/10	WordPress Year Make Model Search for WooCommerce plugin <= 1.0.11 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	May 19, 2025 1y ago
CVE-2025-48264	medium	4.3/10	WordPress Product Code for WooCommerce plugin <= 1.5.0 - CSRF to Database Update vulnerability	May 19, 2025 1y ago
CVE-2025-48254	medium	6.5/10	WordPress Change Add to Cart Button Text for WooCommerce plugin <= 2.2.2 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48253	medium	6.5/10	WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.6 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48251	medium	6.5/10	WordPress Additional Custom Emails & Recipients for WooCommerce plugin <= 3.5.1 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48250	medium	6.5/10	WordPress Coupons & Add to Cart by URL Links for WooCommerce plugin <= 1.7.7 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48249	medium	6.5/10	WordPress EAN for WooCommerce plugin <= 5.4.6 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48248	medium	6.5/10	WordPress Sitewide Discount for WooCommerce: Apply Discount to All Products plugin <= 2.2.1 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48240	medium	6.5/10	WordPress Cost of Goods for WooCommerce plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48239	medium	6.5/10	WordPress Product Notes Tab & Private Admin Notes for WooCommerce plugin <= 3.1.0 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48237	medium	6.5/10	WordPress Wishlist for WooCommerce plugin <= 3.2.2 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-4101	medium	4.3/10	MultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion	May 17, 2025 1y ago
CVE-2025-32180	medium	6.5/10	WordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability	May 16, 2025 1y ago
CVE-2025-39537	high	7.1/10	WordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability	May 16, 2025 1y ago
CVE-2025-48144	high	7.1/10	WordPress Import Export For WooCommerce plugin <= 1.6.2 - CSRF to Stored XSS vulnerability	May 16, 2025 1y ago
CVE-2025-48128	medium	4.3/10	WordPress Sharespine Woocommerce Connector plugin <= 4.7.55 - Broken Access Control Vulnerability	May 16, 2025 1y ago
CVE-2025-48117	medium	5.3/10	WordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control Vulnerability	May 16, 2025 1y ago
CVE-2025-2203	—	—	WooCommerce Checkout & Funnel Builder by FunnelKit < 3.10.2 - Admin+ SQL Injection	May 15, 2025 1y ago
CVE-2025-1303	—	—	Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSS	May 15, 2025 1y ago
CVE-2025-1289	—	—	Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Admin+ Stored XSS	May 15, 2025 1y ago