Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,493

All time

Critical · Active

11,005

CVSS ≥ 9.0

New · 14 days

2,905

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 901–930 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-11829	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 1, 2025 1y ago
CVE-2024-13341	medium	6.5/10	MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.1.11 - Authenticated (Subscriber+) SQL Injection	Feb 1, 2025 1y ago
CVE-2024-13343	high	8.8/10	WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	Feb 1, 2025 1y ago
CVE-2024-13472	high	7.3/10	WooCommerce Product Table Lite <= 3.9.4 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting	Jan 31, 2025 1y ago
CVE-2025-24632	high	7.1/10	WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.9.0 -Reflected Cross Site Scripting (XSS) vulnerability	Jan 31, 2025 1y ago
CVE-2025-24597	medium	6.5/10	WordPress Barcode Generator for WooCommerce plugin <= 2.0.2 - Sensitive Data Exposure vulnerability	Jan 31, 2025 1y ago
CVE-2025-24551	high	7.1/10	WordPress Radio Buttons and Swatches for WooCommerce plugin <= 1.1.20 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 31, 2025 1y ago
CVE-2024-13623	medium	5.9/10	Order Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Jan 31, 2025 1y ago
CVE-2024-13424	medium	4.3/10	Ni Sales Commission For WooCommerce <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update	Jan 31, 2025 1y ago
CVE-2024-13415	medium	4.3/10	Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 5.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update	Jan 31, 2025 1y ago
CVE-2025-0493	critical	9.8/10	MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.14 - Unauthenticated Limited Local File Inclusion	Jan 31, 2025 1y ago
CVE-2024-10591	high	8.8/10	MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update	Jan 30, 2025 1y ago
CVE-2024-12861	medium	6.5/10	W2S – Migrate WooCommerce to Shopify <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read	Jan 30, 2025 1y ago
CVE-2024-13652	medium	4.3/10	ECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion	Jan 30, 2025 1y ago
CVE-2024-13694	high	7.5/10	WooCommerce Wishlist <= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file Function	Jan 30, 2025 1y ago
CVE-2024-13696	high	7.2/10	Flexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter	Jan 29, 2025 1y ago
CVE-2025-24603	medium	4.3/10	WordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin <= 3.4.10 - Broken Access Control vulnerability	Jan 27, 2025 1y ago
CVE-2024-12334	medium	6.1/10	WC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.4 - Reflected Cross-Site Scripting	Jan 26, 2025 1y ago
CVE-2024-12826	medium	4.3/10	GoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Update	Jan 25, 2025 1y ago
CVE-2024-12600	high	7.2/10	Custom Product Tabs Lite for WooCommerce <= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injection	Jan 25, 2025 1y ago
CVE-2025-24755	medium	6.5/10	WordPress PDF Invoice Builder for WooCommerce plugin <= 4.6.0 - Cross Site Scripting (XSS) vulnerability	Jan 24, 2025 1y ago
CVE-2025-24705	medium	5.3/10	WordPress WooCommerce Quick View plugin <= 1.1.1 - Sensitive Data Exposure vulnerability	Jan 24, 2025 1y ago
CVE-2025-24681	medium	5.9/10	WordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin <= 1.10.0 - Cross Site Scripting (XSS) vulnerability	Jan 24, 2025 1y ago
CVE-2025-24668	medium	5.9/10	WordPress PPOM for WooCommerce plugin <= 33.0.8 - Cross Site Scripting (XSS) vulnerability	Jan 24, 2025 1y ago
CVE-2025-24657	medium	5.9/10	WordPress Wishlist for WooCommerce plugin <=2.1.2 - Cross Site Scripting (XSS) vulnerability	Jan 24, 2025 1y ago
CVE-2025-24644	medium	5.9/10	WordPress WooCommerce PDF Invoices plugin <= 4.7.1 - Stored Cross Site Scripting (XSS) vulnerability	Jan 24, 2025 1y ago
CVE-2025-24647	medium	5.4/10	WordPress WooCommerce Cloak Affiliate Links plugin <= 1.0.35 - Cross Site Request Forgery (CSRF) vulnerability	Jan 24, 2025 1y ago
CVE-2025-24625	medium	4.3/10	WordPress Taxonomy/Term and Role based Discounts for WooCommerce plugin <= 5.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability	Jan 24, 2025 1y ago
CVE-2025-24633	medium	5.3/10	WordPress Build Private Store For Woocommerce plugin <= 1.0 - Broken Access Control vulnerability	Jan 24, 2025 1y ago
CVE-2025-24596	medium	5.3/10	WordPress WooCommerce Product Table Lite plugin <= 3.8.7 - Broken Access Control vulnerability	Jan 24, 2025 1y ago