Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,464

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,090

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 961–990 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-0864	medium	6.1/10	Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scripting	Feb 18, 2025 1y ago
CVE-2024-13315	high	8.8/10	Shopwarden – Automated WooCommerce monitoring & testing <= 1.0.11 - Cross-Site Request Forgery to Arbitrary Options Update	Feb 18, 2025 1y ago
CVE-2024-13622	high	7.5/10	File Uploads Addon for WooCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Feb 18, 2025 1y ago
CVE-2024-13540	medium	5.3/10	WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure	Feb 18, 2025 1y ago
CVE-2024-13538	medium	5.3/10	BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute	Feb 18, 2025 1y ago
CVE-2024-13525	medium	6.5/10	Customer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure	Feb 15, 2025 1y ago
CVE-2024-13513	critical	9.8/10	Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation	Feb 15, 2025 1y ago
CVE-2025-24592	high	7.1/10	WordPress SysBasics Customize My Account for WooCommerce plugin <= 2.8.22 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 14, 2025 1y ago
CVE-2025-23789	high	7.1/10	WordPress URL Shortener WooCommerce Plugin <= 9.0.2 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 14, 2025 1y ago
CVE-2024-13692	medium	5.4/10	Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference	Feb 14, 2025 1y ago
CVE-2024-13641	medium	5.9/10	Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Feb 14, 2025 1y ago
CVE-2024-13528	high	7.5/10	Customer Email Verification for WooCommerce <= 2.9.5 - Authentication Bypass via Shortcode	Feb 12, 2025 1y ago
CVE-2024-11746	medium	6.4/10	Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 12, 2025 1y ago
CVE-2024-13487	high	7.3/10	CURCY – Multi Currency for WooCommerce <= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function	Feb 6, 2025 1y ago
CVE-2025-24373	medium	6.3/10	Unrestricted Access to PDF Documents via URL Manipulation in woocommerce-pdf-invoices-packing-slips	Feb 4, 2025 1y ago
CVE-2025-22674	medium	6.5/10	WordPress Product Blocks for WooCommerce plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability	Feb 4, 2025 1y ago
CVE-2025-24661	high	8.8/10	WordPress Taxi Booking Manager for WooCommerce plugin <= 1.1.8 - PHP Object Injection vulnerability	Feb 3, 2025 1y ago
CVE-2025-22694	medium	4.3/10	WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability	Feb 3, 2025 1y ago
CVE-2025-24639	medium	6.5/10	WordPress Korea for WooCommerce plugin <= 1.1.11 - Sensitive Data Exposure vulnerability	Feb 3, 2025 1y ago
CVE-2025-24574	high	7.1/10	WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 3, 2025 1y ago
CVE-2024-13775	medium	5.4/10	WooCommerce Support Ticket System <= 17.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Information Exposure	Feb 1, 2025 1y ago
CVE-2024-11829	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 1, 2025 1y ago
CVE-2024-13341	medium	6.5/10	MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.1.11 - Authenticated (Subscriber+) SQL Injection	Feb 1, 2025 1y ago
CVE-2024-13343	high	8.8/10	WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	Feb 1, 2025 1y ago
CVE-2024-13472	high	7.3/10	WooCommerce Product Table Lite <= 3.9.4 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting	Jan 31, 2025 1y ago
CVE-2025-24632	high	7.1/10	WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.9.0 -Reflected Cross Site Scripting (XSS) vulnerability	Jan 31, 2025 1y ago
CVE-2025-24597	medium	6.5/10	WordPress Barcode Generator for WooCommerce plugin <= 2.0.2 - Sensitive Data Exposure vulnerability	Jan 31, 2025 1y ago
CVE-2025-24551	high	7.1/10	WordPress Radio Buttons and Swatches for WooCommerce plugin <= 1.1.20 - Reflected Cross Site Scripting (XSS) vulnerability	Jan 31, 2025 1y ago
CVE-2024-13623	medium	5.9/10	Order Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	Jan 31, 2025 1y ago
CVE-2024-13424	medium	4.3/10	Ni Sales Commission For WooCommerce <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update	Jan 31, 2025 1y ago