Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,252

All time

Critical · Active

12,442

CVSS ≥ 9.0

New · 14 days

2,159

Newly disclosed

Feed last synced

40 mins ago

Data freshness

Showing 961–990 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-10860	medium	4.3/10	NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission	Feb 28, 2025 1y ago
CVE-2024-13831	high	7.2/10	Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs	Feb 28, 2025 1y ago
CVE-2024-13638	medium	5.9/10	Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Feb 28, 2025 1y ago
CVE-2024-8425	critical	9.8/10	WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload	Feb 28, 2025 1y ago
CVE-2024-10563	—	—	WooCommerce Cart Count Shortcode < 1.1.0 - Contributor+ XSS	Feb 26, 2025 1y ago
CVE-2025-26928	medium	4.3/10	WordPress Order Limit for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability	Feb 25, 2025 1y ago
CVE-2025-26878	medium	6.5/10	WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.8.0.1 - Cross Site Scripting (XSS) vulnerability	Feb 25, 2025 1y ago
CVE-2025-22632	high	7.1/10	WordPress WooCommerce Pricing – Product Pricing plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability	Feb 23, 2025 1y ago
CVE-2024-13461	medium	6.4/10	Autoship Cloud for WooCommerce Subscription Products <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 21, 2025 1y ago
CVE-2024-13792	high	7.3/10	WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids	Feb 20, 2025 1y ago
CVE-2024-13520	medium	5.3/10	Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.9 - Missing Authorization to Unauthenticated Price, Date, and Note Updates	Feb 20, 2025 1y ago
CVE-2025-1064	medium	6.4/10	Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode	Feb 20, 2025 1y ago
CVE-2025-22639	high	8.5/10	WordPress Distance Rate Shipping for WooCommerce plugin <= 1.3.4 - SQL Injection vulnerability	Feb 18, 2025 1y ago
CVE-2024-13797	high	7.3/10	PressMart - Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution	Feb 18, 2025 1y ago
CVE-2024-13718	medium	4.3/10	Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification	Feb 18, 2025 1y ago
CVE-2025-0864	medium	6.1/10	Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scripting	Feb 18, 2025 1y ago
CVE-2024-13315	high	8.8/10	Shopwarden – Automated WooCommerce monitoring & testing <= 1.0.11 - Cross-Site Request Forgery to Arbitrary Options Update	Feb 18, 2025 1y ago
CVE-2024-13622	high	7.5/10	File Uploads Addon for WooCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Feb 18, 2025 1y ago
CVE-2024-13540	medium	5.3/10	WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure	Feb 18, 2025 1y ago
CVE-2024-13538	medium	5.3/10	BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute	Feb 18, 2025 1y ago
CVE-2024-13525	medium	6.5/10	Customer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure	Feb 15, 2025 1y ago
CVE-2024-13513	critical	9.8/10	Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation	Feb 15, 2025 1y ago
CVE-2025-24592	high	7.1/10	WordPress SysBasics Customize My Account for WooCommerce plugin <= 2.8.22 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 14, 2025 1y ago
CVE-2025-23789	high	7.1/10	WordPress URL Shortener WooCommerce Plugin <= 9.0.2 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 14, 2025 1y ago
CVE-2024-13692	medium	5.4/10	Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference	Feb 14, 2025 1y ago
CVE-2024-13641	medium	5.9/10	Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Feb 14, 2025 1y ago
CVE-2024-13528	high	7.5/10	Customer Email Verification for WooCommerce <= 2.9.5 - Authentication Bypass via Shortcode	Feb 12, 2025 1y ago
CVE-2024-11746	medium	6.4/10	Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 12, 2025 1y ago
CVE-2024-13487	high	7.3/10	CURCY – Multi Currency for WooCommerce <= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function	Feb 6, 2025 1y ago
CVE-2025-24373	medium	6.3/10	Unrestricted Access to PDF Documents via URL Manipulation in woocommerce-pdf-invoices-packing-slips	Feb 4, 2025 1y ago