Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,464

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,090

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 931–960 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-13724	medium	4.3/10	Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorization	Mar 4, 2025 1y ago
CVE-2024-13682	medium	4.3/10	Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Cross-Site Request Forgery	Mar 4, 2025 1y ago
CVE-2025-26988	critical	9.3/10	WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - SQL Injection vulnerability	Mar 3, 2025 1y ago
CVE-2025-26984	high	7.1/10	WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-26535	critical	9.3/10	WordPress Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop plugin <= 1.7.6 - SQL Injection vulnerability	Mar 3, 2025 1y ago
CVE-2025-25119	high	7.1/10	WordPress Woocommerce osCommerce Sync plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23903	high	7.1/10	WordPress Local Shipping Labels for WooCommerce Plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23731	high	7.1/10	WordPress Tax Report for WooCommerce plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23668	high	7.1/10	WordPress ChatGPT Open AI Images & Content for WooCommerce plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23481	high	7.1/10	WordPress Ni WooCommerce Sales Report Email plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2025-23450	high	7.1/10	WordPress AW WooCommerce Kode Pembayaran plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 3, 2025 1y ago
CVE-2024-9212	medium	6.1/10	SKU Generator for WooCommerce <= 1.6.2 - Reflected Cross-Site Scripting	Mar 1, 2025 1y ago
CVE-2024-9217	medium	6.1/10	Currency Switcher for WooCommerce <= 2.16.2 - Reflected Cross-Site Scripting	Mar 1, 2025 1y ago
CVE-2024-13750	medium	6.5/10	Multilevel Referral Affiliate Plugin for WooCommerce <= 2.28 - Authenticated (Subscriber+) SQL Injection	Mar 1, 2025 1y ago
CVE-2024-13358	medium	4.3/10	BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update	Mar 1, 2025 1y ago
CVE-2024-10860	medium	4.3/10	NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission	Feb 28, 2025 1y ago
CVE-2024-13831	high	7.2/10	Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs	Feb 28, 2025 1y ago
CVE-2024-13638	medium	5.9/10	Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Feb 28, 2025 1y ago
CVE-2024-8425	critical	9.8/10	WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload	Feb 28, 2025 1y ago
CVE-2024-10563	—	—	WooCommerce Cart Count Shortcode < 1.1.0 - Contributor+ XSS	Feb 26, 2025 1y ago
CVE-2025-26928	medium	4.3/10	WordPress Order Limit for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability	Feb 25, 2025 1y ago
CVE-2025-26878	medium	6.5/10	WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.8.0.1 - Cross Site Scripting (XSS) vulnerability	Feb 25, 2025 1y ago
CVE-2025-22632	high	7.1/10	WordPress WooCommerce Pricing – Product Pricing plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability	Feb 23, 2025 1y ago
CVE-2024-13461	medium	6.4/10	Autoship Cloud for WooCommerce Subscription Products <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 21, 2025 1y ago
CVE-2024-13792	high	7.3/10	WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids	Feb 20, 2025 1y ago
CVE-2024-13520	medium	5.3/10	Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.9 - Missing Authorization to Unauthenticated Price, Date, and Note Updates	Feb 20, 2025 1y ago
CVE-2025-1064	medium	6.4/10	Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode	Feb 20, 2025 1y ago
CVE-2025-22639	high	8.5/10	WordPress Distance Rate Shipping for WooCommerce plugin <= 1.3.4 - SQL Injection vulnerability	Feb 18, 2025 1y ago
CVE-2024-13797	high	7.3/10	PressMart - Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution	Feb 18, 2025 1y ago
CVE-2024-13718	medium	4.3/10	Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification	Feb 18, 2025 1y ago