Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,464

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,092

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 751–780 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-4564	critical	9.8/10	TicketBAI Facturas para WooCommerce <= 3.18 - Unauthenticated Arbitrary File Deletion	May 15, 2025 1y ago
CVE-2025-47682	critical	9.3/10	WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.8.1 - SQL Injection Vulnerability	May 12, 2025 1y ago
CVE-2025-3878	medium	6.4/10	SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode	May 10, 2025 1y ago
CVE-2025-3876	high	8.8/10	SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function	May 10, 2025 1y ago
CVE-2025-4403	critical	9.8/10	Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function	May 9, 2025 1y ago
CVE-2024-13793	high	7.3/10	Wolmart \| Multi-Vendor Marketplace WooCommerce Theme <= 1.8.11 - Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmore	May 8, 2025 1y ago
CVE-2025-47649	high	8.8/10	WordPress Open Close WooCommerce Store plugin <= 4.9.9 - Local File Inclusion vulnerability	May 7, 2025 1y ago
CVE-2025-47648	high	7.1/10	WordPress Pays – WooCommerce Payment Gateway plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability	May 7, 2025 1y ago
CVE-2025-47643	high	7.6/10	WordPress ELEX Product Feed for WooCommerce <= 3.1.2 - SQL Injection Vulnerability	May 7, 2025 1y ago
CVE-2025-47633	medium	4.3/10	WordPress Awin – Advertiser Tracking for WooCommerce plugin <= 2.0.0 - CSRF to Product Feed Regeneration vulnerability	May 7, 2025 1y ago
CVE-2025-47602	medium	5.4/10	WordPress Calculate Prices based on Distance For WooCommerce plugin <= 1.3.5 - Broken Access Control vulnerability	May 7, 2025 1y ago
CVE-2025-47592	medium	5.9/10	WordPress Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL plugin <= 2.0.8 - Cross Site Scripting (XSS) Vulnerability	May 7, 2025 1y ago
CVE-2025-47544	high	7.6/10	WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.8 - SQL Injection Vulnerability	May 7, 2025 1y ago
CVE-2025-47538	high	7.6/10	WordPress Cart tracking for WooCommerce plugin <= 1.0.17 - SQL Injection Vulnerability	May 7, 2025 1y ago
CVE-2025-47537	high	7.6/10	WordPress PDF Invoice Builder for WooCommerce plugin <= 5.3.8 - SQL Injection Vulnerability	May 7, 2025 1y ago
CVE-2025-47526	medium	5.4/10	WordPress GS Variation Swatches for WooCommerce plugin <= 3.0.4 - Broken Access Control Vulnerability	May 7, 2025 1y ago
CVE-2025-47505	medium	6.5/10	WordPress Product Time Countdown for WooCommerce plugin <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability	May 7, 2025 1y ago
CVE-2025-47504	medium	6.5/10	WordPress Custom Checkout Fields for WooCommerce plugin <= 1.8.3 - Cross Site Scripting (XSS) Vulnerability	May 7, 2025 1y ago
CVE-2025-47473	medium	5.4/10	WordPress PW WooCommerce Bulk Edit plugin <= 2.134 - Cross Site Request Forgery (CSRF) Vulnerability	May 7, 2025 1y ago
CVE-2025-47472	medium	5.4/10	WordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control Vulnerability	May 7, 2025 1y ago
CVE-2025-47460	high	7.6/10	WordPress TrackShip for WooCommerce plugin <= 1.9.1 - SQL Injection Vulnerability	May 7, 2025 1y ago
CVE-2025-47455	medium	4.7/10	WordPress Integration for WooCommerce and Salesforce plugin <= 1.7.5 - Open Redirection Vulnerability	May 7, 2025 1y ago
CVE-2025-47451	medium	4.3/10	WordPress Product Quantity Dropdown For Woocommerce plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	May 7, 2025 1y ago
CVE-2025-4335	high	8.8/10	Woocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation	May 7, 2025 1y ago
CVE-2024-13344	high	7.5/10	Advance Seat Reservation Management for WooCommerce <= 3.3 - Unauthenticated SQL Injection	May 2, 2025 1y ago
CVE-2025-2168	medium	4.3/10	Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update	May 1, 2025 1y ago
CVE-2025-2907	—	—	Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update	Apr 26, 2025 1y ago
CVE-2025-3906	high	8.8/10	Integração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	Apr 26, 2025 1y ago
CVE-2025-3743	medium	5.3/10	Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation	Apr 25, 2025 1y ago
CVE-2025-3775	medium	6.5/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter	Apr 25, 2025 1y ago