Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,229

All time

Critical · Active

12,441

CVSS ≥ 9.0

New · 14 days

2,145

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 751–780 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-48249	medium	6.5/10	WordPress EAN for WooCommerce plugin <= 5.4.6 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48248	medium	6.5/10	WordPress Sitewide Discount for WooCommerce: Apply Discount to All Products plugin <= 2.2.1 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48240	medium	6.5/10	WordPress Cost of Goods for WooCommerce plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48239	medium	6.5/10	WordPress Product Notes Tab & Private Admin Notes for WooCommerce plugin <= 3.1.0 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-48237	medium	6.5/10	WordPress Wishlist for WooCommerce plugin <= 3.2.2 - Cross Site Scripting (XSS) Vulnerability	May 19, 2025 1y ago
CVE-2025-4101	medium	4.3/10	MultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion	May 17, 2025 1y ago
CVE-2025-32180	medium	6.5/10	WordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability	May 16, 2025 1y ago
CVE-2025-39537	high	7.1/10	WordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability	May 16, 2025 1y ago
CVE-2025-48144	high	7.1/10	WordPress Import Export For WooCommerce plugin <= 1.6.2 - CSRF to Stored XSS vulnerability	May 16, 2025 1y ago
CVE-2025-48128	medium	4.3/10	WordPress Sharespine Woocommerce Connector plugin <= 4.7.55 - Broken Access Control Vulnerability	May 16, 2025 1y ago
CVE-2025-48117	medium	5.3/10	WordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control Vulnerability	May 16, 2025 1y ago
CVE-2025-2203	—	—	WooCommerce Checkout & Funnel Builder by FunnelKit < 3.10.2 - Admin+ SQL Injection	May 15, 2025 1y ago
CVE-2025-1303	—	—	Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSS	May 15, 2025 1y ago
CVE-2025-1289	—	—	Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Admin+ Stored XSS	May 15, 2025 1y ago
CVE-2025-4564	critical	9.8/10	TicketBAI Facturas para WooCommerce <= 3.18 - Unauthenticated Arbitrary File Deletion	May 15, 2025 1y ago
CVE-2025-47682	critical	9.3/10	WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.8.1 - SQL Injection Vulnerability	May 12, 2025 1y ago
CVE-2025-3878	medium	6.4/10	SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode	May 10, 2025 1y ago
CVE-2025-3876	high	8.8/10	SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function	May 10, 2025 1y ago
CVE-2025-4403	critical	9.8/10	Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function	May 9, 2025 1y ago
CVE-2024-13793	high	7.3/10	Wolmart \| Multi-Vendor Marketplace WooCommerce Theme <= 1.8.11 - Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmore	May 8, 2025 1y ago
CVE-2025-47649	high	8.8/10	WordPress Open Close WooCommerce Store plugin <= 4.9.9 - Local File Inclusion vulnerability	May 7, 2025 1y ago
CVE-2025-47648	high	7.1/10	WordPress Pays – WooCommerce Payment Gateway plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability	May 7, 2025 1y ago
CVE-2025-47643	high	7.6/10	WordPress ELEX Product Feed for WooCommerce <= 3.1.2 - SQL Injection Vulnerability	May 7, 2025 1y ago
CVE-2025-47633	medium	4.3/10	WordPress Awin – Advertiser Tracking for WooCommerce plugin <= 2.0.0 - CSRF to Product Feed Regeneration vulnerability	May 7, 2025 1y ago
CVE-2025-47602	medium	5.4/10	WordPress Calculate Prices based on Distance For WooCommerce plugin <= 1.3.5 - Broken Access Control vulnerability	May 7, 2025 1y ago
CVE-2025-47592	medium	5.9/10	WordPress Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL plugin <= 2.0.8 - Cross Site Scripting (XSS) Vulnerability	May 7, 2025 1y ago
CVE-2025-47544	high	7.6/10	WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.8 - SQL Injection Vulnerability	May 7, 2025 1y ago
CVE-2025-47538	high	7.6/10	WordPress Cart tracking for WooCommerce plugin <= 1.0.17 - SQL Injection Vulnerability	May 7, 2025 1y ago
CVE-2025-47537	high	7.6/10	WordPress PDF Invoice Builder for WooCommerce plugin <= 5.3.8 - SQL Injection Vulnerability	May 7, 2025 1y ago
CVE-2025-47526	medium	5.4/10	WordPress GS Variation Swatches for WooCommerce plugin <= 3.0.4 - Broken Access Control Vulnerability	May 7, 2025 1y ago