Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,138

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,111

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-16285	—	—	WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download	Aug 2, 2026 1mo ago
CVE-2026-16063	—	—	Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content	Aug 2, 2026 1mo ago
CVE-2026-16062	—	—	Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content	Aug 2, 2026 1mo ago
CVE-2026-15206	—	—	SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile	Aug 2, 2026 1mo ago
CVE-2026-8457	critical	9.8/10	WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT	Aug 1, 2026 1mo ago
CVE-2025-14073	medium	5.3/10	WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure	Aug 1, 2026 1mo ago
CVE-2026-15414	high	8.8/10	Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta	Aug 1, 2026 1mo ago
CVE-2026-15258	—	—	Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter	Jul 31, 2026 1mo ago
CVE-2026-15397	high	7.2/10	Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action	Jul 30, 2026 1mo ago
CVE-2026-11782	—	—	Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR	Jul 30, 2026 1mo ago
CVE-2026-14270	high	8.8/10	Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings	Jul 29, 2026 1mo ago
CVE-2026-7436	medium	6.4/10	WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute	Jul 29, 2026 1mo ago
CVE-2026-16597	high	7.2/10	GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields	Jul 29, 2026 1mo ago
CVE-2025-10656	critical	9.8/10	Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation	Jul 29, 2026 1mo ago
CVE-2026-13110	medium	5.3/10	StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action	Jul 28, 2026 1mo ago
CVE-2026-15411	medium	5.3/10	StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action	Jul 28, 2026 1mo ago
CVE-2026-13440	high	7.2/10	StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter	Jul 28, 2026 1mo ago
CVE-2026-65434	medium	6.5/10	WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerability	Jul 27, 2026 1mo ago
CVE-2026-59556	high	7.1/10	WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.11 - Cross Site Scripting (XSS) vulnerability	Jul 27, 2026 1mo ago
CVE-2026-59530	high	7.5/10	WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability	Jul 27, 2026 1mo ago
CVE-2026-15648	medium	6.4/10	Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute	Jul 24, 2026 1mo ago
CVE-2026-12654	medium	5.3/10	Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret	Jul 24, 2026 1mo ago
CVE-2026-61945	medium	6.5/10	WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability	Jul 23, 2026 1mo ago
CVE-2026-65532	high	7.6/10	WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability	Jul 23, 2026 1mo ago
CVE-2026-65501	medium	5.3/10	WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability	Jul 23, 2026 1mo ago
CVE-2026-65457	medium	4.3/10	WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability	Jul 23, 2026 1mo ago
CVE-2026-65456	medium	4.3/10	WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability	Jul 23, 2026 1mo ago
CVE-2026-59547	high	7.5/10	WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability	Jul 23, 2026 1mo ago
CVE-2026-59512	high	7.1/10	WordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerability	Jul 23, 2026 1mo ago
CVE-2026-57425	medium	6.5/10	WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability	Jul 23, 2026 1mo ago