Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

355,733

All time

Critical · Active

12,692

CVSS ≥ 9.0

New · 14 days

2,176

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 811–840 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-47526	medium	5.4/10	WordPress GS Variation Swatches for WooCommerce plugin <= 3.0.4 - Broken Access Control Vulnerability	May 7, 2025 1y ago
CVE-2025-47505	medium	6.5/10	WordPress Product Time Countdown for WooCommerce plugin <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability	May 7, 2025 1y ago
CVE-2025-47504	medium	6.5/10	WordPress Custom Checkout Fields for WooCommerce plugin <= 1.8.3 - Cross Site Scripting (XSS) Vulnerability	May 7, 2025 1y ago
CVE-2025-47473	medium	5.4/10	WordPress PW WooCommerce Bulk Edit plugin <= 2.134 - Cross Site Request Forgery (CSRF) Vulnerability	May 7, 2025 1y ago
CVE-2025-47472	medium	5.4/10	WordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control Vulnerability	May 7, 2025 1y ago
CVE-2025-47460	high	7.6/10	WordPress TrackShip for WooCommerce plugin <= 1.9.1 - SQL Injection Vulnerability	May 7, 2025 1y ago
CVE-2025-47455	medium	4.7/10	WordPress Integration for WooCommerce and Salesforce plugin <= 1.7.5 - Open Redirection Vulnerability	May 7, 2025 1y ago
CVE-2025-47451	medium	4.3/10	WordPress Product Quantity Dropdown For Woocommerce plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	May 7, 2025 1y ago
CVE-2025-4335	high	8.8/10	Woocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation	May 7, 2025 1y ago
CVE-2024-13344	high	7.5/10	Advance Seat Reservation Management for WooCommerce <= 3.3 - Unauthenticated SQL Injection	May 2, 2025 1y ago
CVE-2025-2168	medium	4.3/10	Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update	May 1, 2025 1y ago
CVE-2025-2907	—	—	Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update	Apr 26, 2025 1y ago
CVE-2025-3906	high	8.8/10	Integração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	Apr 26, 2025 1y ago
CVE-2025-3743	medium	5.3/10	Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation	Apr 25, 2025 1y ago
CVE-2025-3775	medium	6.5/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter	Apr 25, 2025 1y ago
CVE-2025-46489	medium	5.3/10	WordPress Bulk Assign Linked Products For WooCommerce plugin <= 2.1 - Broken Access Control Vulnerability	Apr 24, 2025 1y ago
CVE-2025-39378	high	7.5/10	WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Local File Inclusion vulnerability	Apr 24, 2025 1y ago
CVE-2025-39391	high	7.5/10	WordPress Checkout Field Visibility for WooCommerce plugin <= 1.3.0 - Local File Inclusion vulnerability	Apr 24, 2025 1y ago
CVE-2025-3280	medium	6.5/10	ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Subscriber+) SQL Injection	Apr 24, 2025 1y ago
CVE-2025-1284	medium	4.3/10	Woocommerce Automatic Order Printing \| ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure	Apr 24, 2025 1y ago
CVE-2025-46244	medium	5.3/10	WordPress Advanced Linked Variations for Woocommerce plugin <= 1.0.3 - Broken Access Control Vulnerability	Apr 22, 2025 1y ago
CVE-2025-46243	medium	4.3/10	WordPress Recover abandoned cart for WooCommerce plugin <= 2.2 - Cross Site Request Forgery (CSRF) Vulnerability	Apr 22, 2025 1y ago
CVE-2025-3814	medium	6.4/10	Tax Switch for WooCommerce <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via class-name Parameter	Apr 22, 2025 1y ago
CVE-2025-3598	medium	6.1/10	Coupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter	Apr 18, 2025 1y ago
CVE-2025-24553	high	7.1/10	WordPress Shipping with Venipak for WooCommerce plugin <= 1.22.3 - Reflected Cross Site Scripting (XSS) vulnerability	Apr 17, 2025 1y ago
CVE-2025-24586	high	7.1/10	WordPress Shipment Tracker for Woocommerce plugin <= 1.4.23 - Cross Site Scripting (XSS) vulnerability	Apr 17, 2025 1y ago
CVE-2025-32512	high	7.1/10	WordPress Revamp CRM for WooCommerce plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability	Apr 17, 2025 1y ago
CVE-2025-32511	high	7.1/10	WordPress Make Email Customizer for WooCommerce plugin <= 1.0.6 - Reflected Cross Site Scripting (XSS) vulnerability	Apr 17, 2025 1y ago
CVE-2025-32514	high	7.1/10	WordPress WooCommerce Estimate and Quote plugin <= 1.0.2.5 - Reflected Cross Site Scripting (XSS) vulnerability	Apr 17, 2025 1y ago
CVE-2025-32513	high	7.1/10	WordPress Total processing card payments for WooCommerce plugin <= 7.1.6 - Reflected Cross Site Scripting (XSS) vulnerability	Apr 17, 2025 1y ago