Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,490

All time

Critical · Active

11,004

CVSS ≥ 9.0

New · 14 days

2,904

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 871–900 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-26878	medium	6.5/10	WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.8.0.1 - Cross Site Scripting (XSS) vulnerability	Feb 25, 2025 1y ago
CVE-2025-22632	high	7.1/10	WordPress WooCommerce Pricing – Product Pricing plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability	Feb 23, 2025 1y ago
CVE-2024-13461	medium	6.4/10	Autoship Cloud for WooCommerce Subscription Products <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 21, 2025 1y ago
CVE-2024-13792	high	7.3/10	WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids	Feb 20, 2025 1y ago
CVE-2024-13520	medium	5.3/10	Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.9 - Missing Authorization to Unauthenticated Price, Date, and Note Updates	Feb 20, 2025 1y ago
CVE-2025-1064	medium	6.4/10	Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode	Feb 20, 2025 1y ago
CVE-2025-22639	high	8.5/10	WordPress Distance Rate Shipping for WooCommerce plugin <= 1.3.4 - SQL Injection vulnerability	Feb 18, 2025 1y ago
CVE-2024-13797	high	7.3/10	PressMart - Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution	Feb 18, 2025 1y ago
CVE-2024-13718	medium	4.3/10	Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification	Feb 18, 2025 1y ago
CVE-2025-0864	medium	6.1/10	Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scripting	Feb 18, 2025 1y ago
CVE-2024-13315	high	8.8/10	Shopwarden – Automated WooCommerce monitoring & testing <= 1.0.11 - Cross-Site Request Forgery to Arbitrary Options Update	Feb 18, 2025 1y ago
CVE-2024-13622	high	7.5/10	File Uploads Addon for WooCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Feb 18, 2025 1y ago
CVE-2024-13540	medium	5.3/10	WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure	Feb 18, 2025 1y ago
CVE-2024-13538	medium	5.3/10	BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute	Feb 18, 2025 1y ago
CVE-2024-13525	medium	6.5/10	Customer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure	Feb 15, 2025 1y ago
CVE-2024-13513	critical	9.8/10	Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation	Feb 15, 2025 1y ago
CVE-2025-24592	high	7.1/10	WordPress SysBasics Customize My Account for WooCommerce plugin <= 2.8.22 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 14, 2025 1y ago
CVE-2025-23789	high	7.1/10	WordPress URL Shortener WooCommerce Plugin <= 9.0.2 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 14, 2025 1y ago
CVE-2024-13692	medium	5.4/10	Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference	Feb 14, 2025 1y ago
CVE-2024-13641	medium	5.9/10	Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Feb 14, 2025 1y ago
CVE-2024-13528	high	7.5/10	Customer Email Verification for WooCommerce <= 2.9.5 - Authentication Bypass via Shortcode	Feb 12, 2025 1y ago
CVE-2024-11746	medium	6.4/10	Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 12, 2025 1y ago
CVE-2024-13487	high	7.3/10	CURCY – Multi Currency for WooCommerce <= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function	Feb 6, 2025 1y ago
CVE-2025-24373	medium	6.3/10	Unrestricted Access to PDF Documents via URL Manipulation in woocommerce-pdf-invoices-packing-slips	Feb 4, 2025 1y ago
CVE-2025-22674	medium	6.5/10	WordPress Product Blocks for WooCommerce plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability	Feb 4, 2025 1y ago
CVE-2025-24661	high	8.8/10	WordPress Taxi Booking Manager for WooCommerce plugin <= 1.1.8 - PHP Object Injection vulnerability	Feb 3, 2025 1y ago
CVE-2025-22694	medium	4.3/10	WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability	Feb 3, 2025 1y ago
CVE-2025-24639	medium	6.5/10	WordPress Korea for WooCommerce plugin <= 1.1.11 - Sensitive Data Exposure vulnerability	Feb 3, 2025 1y ago
CVE-2025-24574	high	7.1/10	WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 3, 2025 1y ago
CVE-2024-13775	medium	5.4/10	WooCommerce Support Ticket System <= 17.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Information Exposure	Feb 1, 2025 1y ago