Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,489

All time

Critical · Active

11,003

CVSS ≥ 9.0

New · 14 days

2,916

Newly disclosed

Feed last synced

5 hrs ago

Data freshness

Showing 841–870 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-1287	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Mar 8, 2025 1y ago
CVE-2024-13640	medium	5.9/10	Print Invoice & Delivery Notes for WooCommerce <= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Mar 8, 2025 1y ago
CVE-2024-13774	medium	6.1/10	Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name	Mar 8, 2025 1y ago
CVE-2024-13904	medium	5.3/10	Platform.ly for WooCommerce <= 1.1.6 - Unauthenticated Blind Server-Side Request Forgery	Mar 7, 2025 1y ago
CVE-2024-13320	high	7.5/10	CURCY - WooCommerce Multi Currency - Currency Switcher <= 2.3.6 - Unauthenticated SQL Injection	Mar 7, 2025 1y ago
CVE-2024-13747	medium	4.3/10	WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection	Mar 5, 2025 1y ago
CVE-2024-13810	medium	4.3/10	Zass - WooCommerce Theme for Handmade Artists and Artisans <= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo Import	Mar 5, 2025 1y ago
CVE-2024-13811	medium	4.3/10	Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme <= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import	Mar 5, 2025 1y ago
CVE-2025-0956	high	8.1/10	WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection	Mar 5, 2025 1y ago
CVE-2024-13724	medium	4.3/10	Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorization	Mar 4, 2025 1y ago
CVE-2024-13682	medium	4.3/10	Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Cross-Site Request Forgery	Mar 4, 2025 1y ago
CVE-2025-26988	critical	9.3/10	WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - SQL Injection vulnerability	Mar 3, 2025 1y ago
CVE-2025-26984	high	7.1/10	WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-26535	critical	9.3/10	WordPress Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop plugin <= 1.7.6 - SQL Injection vulnerability	Mar 3, 2025 1y ago
CVE-2025-25119	high	7.1/10	WordPress Woocommerce osCommerce Sync plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23903	high	7.1/10	WordPress Local Shipping Labels for WooCommerce Plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23731	high	7.1/10	WordPress Tax Report for WooCommerce plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23668	high	7.1/10	WordPress ChatGPT Open AI Images & Content for WooCommerce plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23481	high	7.1/10	WordPress Ni WooCommerce Sales Report Email plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23450	high	7.1/10	WordPress AW WooCommerce Kode Pembayaran plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2024-9212	medium	6.1/10	SKU Generator for WooCommerce <= 1.6.2 - Reflected Cross-Site Scripting	Mar 1, 2025 1y ago
CVE-2024-9217	medium	6.1/10	Currency Switcher for WooCommerce <= 2.16.2 - Reflected Cross-Site Scripting	Mar 1, 2025 1y ago
CVE-2024-13750	medium	6.5/10	Multilevel Referral Affiliate Plugin for WooCommerce <= 2.28 - Authenticated (Subscriber+) SQL Injection	Mar 1, 2025 1y ago
CVE-2024-13358	medium	4.3/10	BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update	Mar 1, 2025 1y ago
CVE-2024-10860	medium	4.3/10	NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission	Feb 28, 2025 1y ago
CVE-2024-13831	high	7.2/10	Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs	Feb 28, 2025 1y ago
CVE-2024-13638	medium	5.9/10	Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Feb 28, 2025 1y ago
CVE-2024-8425	critical	9.8/10	WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload	Feb 28, 2025 1y ago
CVE-2024-10563	—	—	WooCommerce Cart Count Shortcode < 1.1.0 - Contributor+ XSS	Feb 26, 2025 1y ago
CVE-2025-26928	medium	4.3/10	WordPress Order Limit for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability	Feb 25, 2025 1y ago