Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,496

All time

Critical · Active

11,005

CVSS ≥ 9.0

New · 14 days

2,907

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 931–960 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-24594	medium	6.5/10	WordPress Linet ERP-Woocommerce Integration plugin <= 3.5.7 - CSRF to Broken Access Control vulnerability	Jan 24, 2025 1y ago
CVE-2025-23991	medium	4.3/10	WordPress Product Size Charts Plugin for WooCommerce plugin <= 2.4.5 - Broken Access Control vulnerability	Jan 24, 2025 1y ago
CVE-2024-13511	medium	4.3/10	Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset	Jan 23, 2025 1y ago
CVE-2025-23966	high	7.1/10	WordPress a Gateway for Pasargad Bank on WooCommerce Plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability	Jan 22, 2025 1y ago
CVE-2025-23495	high	7.1/10	WordPress WooCommerce Order Search plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 22, 2025 1y ago
CVE-2024-13519	medium	4.4/10	MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site Scripting	Jan 18, 2025 1y ago
CVE-2024-13317	medium	4.3/10	ShipWorks Connector for Woocommerce <= 5.2.5 - Cross-Site Request Forgery to Service Password/Username Update	Jan 18, 2025 1y ago
CVE-2025-23452	high	7.1/10	WordPress EditionGuard for WooCommerce plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 16, 2025 1y ago
CVE-2025-23429	high	7.1/10	WordPress Altima Lookbook Free for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability	Jan 16, 2025 1y ago
CVE-2024-13355	medium	5.4/10	Admin and Customer Messages After Order for WooCommerce <= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting	Jan 16, 2025 1y ago
CVE-2025-22724	medium	6.5/10	WordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability	Jan 15, 2025 1y ago
CVE-2025-22731	medium	4.3/10	WordPress Build Private Store For Woocommerce plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability	Jan 15, 2025 1y ago
CVE-2025-22782	critical	9.9/10	WordPress WR Price List Manager For Woocommerce plugin <= 1.0.8 - Remote Code Execution (RCE) vulnerability	Jan 15, 2025 1y ago
CVE-2025-22337	high	7.1/10	WordPress Order Audit Log for WooCommerce plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 13, 2025 1y ago
CVE-2024-12412	medium	6.1/10	Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently \| WordPress plugin <= 2.2.1 - Reflected Cross-Site Scripting	Jan 11, 2025 1y ago
CVE-2024-12116	medium	4.3/10	Unlimited Theme Addon For Elementor and WooCommerce <= 1.2.2 - Authenticated (Contributor+) Post Disclosure	Jan 11, 2025 1y ago
CVE-2024-12204	medium	5.4/10	Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization	Jan 11, 2025 1y ago
CVE-2024-12627	high	7.5/10	Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization to Authenticated (Contributor+) PHP Object Injection	Jan 11, 2025 1y ago
CVE-2025-22307	high	7.1/10	WordPress Product Table for WooCommerce plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2025-22505	high	8.5/10	WordPress NC Wishlist for Woocommerce Plugin <= 1.0.1 - SQL Injection vulnerability	Jan 9, 2025 1y ago
CVE-2025-22801	medium	6.5/10	WordPress Free WooCommerce Theme 99fy Extension plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2025-22803	medium	6.5/10	WordPress Advanced Product Information for WooCommerce plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2025-22809	medium	6.5/10	WordPress PDF Catalog Woocommerce plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability	Jan 9, 2025 1y ago
CVE-2024-11815	medium	6.1/10	Pósturinn\'s Shipping with WooCommerce <= 1.3.1 - Reflected Cross-Site Scripting	Jan 9, 2025 1y ago
CVE-2024-12218	medium	6.1/10	Woocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting	Jan 9, 2025 1y ago
CVE-2024-5769	medium	4.3/10	MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Limited Settings Update	Jan 9, 2025 1y ago
CVE-2024-12222	medium	6.1/10	Deliver via Shipos for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameter	Jan 9, 2025 1y ago
CVE-2024-12337	medium	6.1/10	Shipping via Planzer for WooCommerce <= 1.0.25 - Reflected Cross-Site Scripting via processed-ids	Jan 8, 2025 1y ago
CVE-2024-11423	high	7.5/10	Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch	Jan 8, 2025 1y ago
CVE-2025-22363	medium	5.3/10	WordPress Allada T-shirt Designer for Woocommerce plugin <= 1.1 - Broken Access Control vulnerability	Jan 7, 2025 1y ago