Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,251

All time

Critical · Active

12,441

CVSS ≥ 9.0

New · 14 days

2,160

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 931–960 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-13824	critical	9.8/10	CiyaShop - Multipurpose WooCommerce Theme <= 4.19.0 - Unauthenticated PHP Object Injection	Mar 14, 2025 1y ago
CVE-2025-1527	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module	Mar 12, 2025 1y ago
CVE-2024-12589	medium	6.4/10	Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timer	Mar 12, 2025 1y ago
CVE-2025-1661	critical	9.8/10	HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion	Mar 11, 2025 1y ago
CVE-2025-26933	high	7.5/10	WordPress Place Order Without Payment for WooCommerce plugin <= 2.6.7 - Local File Inclusion vulnerability	Mar 10, 2025 1y ago
CVE-2024-13359	high	8.1/10	Product Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Upload	Mar 8, 2025 1y ago
CVE-2025-1287	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Mar 8, 2025 1y ago
CVE-2024-13640	medium	5.9/10	Print Invoice & Delivery Notes for WooCommerce <= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Mar 8, 2025 1y ago
CVE-2024-13774	medium	6.1/10	Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name	Mar 8, 2025 1y ago
CVE-2024-13904	medium	5.3/10	Platform.ly for WooCommerce <= 1.1.6 - Unauthenticated Blind Server-Side Request Forgery	Mar 7, 2025 1y ago
CVE-2024-13320	high	7.5/10	CURCY - WooCommerce Multi Currency - Currency Switcher <= 2.3.6 - Unauthenticated SQL Injection	Mar 7, 2025 1y ago
CVE-2024-13747	medium	4.3/10	WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection	Mar 5, 2025 1y ago
CVE-2024-13810	medium	4.3/10	Zass - WooCommerce Theme for Handmade Artists and Artisans <= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo Import	Mar 5, 2025 1y ago
CVE-2024-13811	medium	4.3/10	Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme <= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import	Mar 5, 2025 1y ago
CVE-2025-0956	high	8.1/10	WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection	Mar 5, 2025 1y ago
CVE-2024-13724	medium	4.3/10	Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorization	Mar 4, 2025 1y ago
CVE-2024-13682	medium	4.3/10	Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Cross-Site Request Forgery	Mar 4, 2025 1y ago
CVE-2025-26988	critical	9.3/10	WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - SQL Injection vulnerability	Mar 3, 2025 1y ago
CVE-2025-26984	high	7.1/10	WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-26535	critical	9.3/10	WordPress Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop plugin <= 1.7.6 - SQL Injection vulnerability	Mar 3, 2025 1y ago
CVE-2025-25119	high	7.1/10	WordPress Woocommerce osCommerce Sync plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23903	high	7.1/10	WordPress Local Shipping Labels for WooCommerce Plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23731	high	7.1/10	WordPress Tax Report for WooCommerce plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23668	high	7.1/10	WordPress ChatGPT Open AI Images & Content for WooCommerce plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23481	high	7.1/10	WordPress Ni WooCommerce Sales Report Email plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23450	high	7.1/10	WordPress AW WooCommerce Kode Pembayaran plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2024-9212	medium	6.1/10	SKU Generator for WooCommerce <= 1.6.2 - Reflected Cross-Site Scripting	Mar 1, 2025 1y ago
CVE-2024-9217	medium	6.1/10	Currency Switcher for WooCommerce <= 2.16.2 - Reflected Cross-Site Scripting	Mar 1, 2025 1y ago
CVE-2024-13750	medium	6.5/10	Multilevel Referral Affiliate Plugin for WooCommerce <= 2.28 - Authenticated (Subscriber+) SQL Injection	Mar 1, 2025 1y ago
CVE-2024-13358	medium	4.3/10	BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update	Mar 1, 2025 1y ago