Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,521

All time

Critical · Active

11,005

CVSS ≥ 9.0

New · 14 days

2,917

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 961–990 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-56272	medium	4.3/10	WordPress Hide Category by User Role for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerability	Jan 7, 2025 1y ago
CVE-2024-56290	critical	9.3/10	WordPress Multiple Shipping And Billing Address For Woocommerce Plugin <= 1.2 - Unauthenticated SQL Injection vulnerability	Jan 7, 2025 1y ago
CVE-2025-22352	high	7.6/10	WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin <= 1.4.9 - SQL Injection vulnerability	Jan 7, 2025 1y ago
CVE-2024-12781	medium	4.3/10	Aurum - WordPress & WooCommerce Shopping Theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import	Jan 7, 2025 1y ago
CVE-2024-11725	high	8.8/10	SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update	Jan 7, 2025 1y ago
CVE-2024-12384	medium	6.1/10	Binary MLM Woocommerce <= 2.0 - Reflected Cross-Site Scripting via 'page'	Jan 7, 2025 1y ago
CVE-2024-12438	medium	6.1/10	WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket <= 4.75 - Reflected Cross-Site Scripting	Jan 7, 2025 1y ago
CVE-2024-12383	medium	6.1/10	Binary MLM Woocommerce <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting	Jan 7, 2025 1y ago
CVE-2024-11369	medium	6.1/10	Store credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site Scripting	Jan 7, 2025 1y ago
CVE-2024-12435	medium	6.1/10	Compare Products for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting	Jan 7, 2025 1y ago
CVE-2024-12313	high	8.1/10	Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection	Jan 7, 2025 1y ago
CVE-2024-11378	medium	6.1/10	Bizapp for WooCommerce <= 2.0.8 - Reflected Cross-Site Scripting	Jan 7, 2025 1y ago
CVE-2024-12214	medium	6.1/10	WooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink Parameter	Jan 7, 2025 1y ago
CVE-2024-11465	high	7.2/10	Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection	Jan 7, 2025 1y ago
CVE-2024-11934	medium	6.4/10	Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce <= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Jan 7, 2025 1y ago
CVE-2024-12402	critical	9.8/10	Themes Coder – Create Android & iOS Apps For Your Woocommerce Site <= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation	Jan 7, 2025 1y ago
CVE-2023-40327	medium	6.5/10	WordPress Putler Connector for WooCommerce plugin <= 2.12.0 - Unauthenticated Broken Access Control vulnerability	Jan 2, 2025 1y ago
CVE-2023-47180	medium	6.5/10	WordPress Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin <= 2.16.0 - Arbitrary Content Deletion vulnerability	Jan 2, 2025 1y ago
CVE-2023-46635	medium	5.3/10	WordPress YITH WooCommerce Product Add-Ons plugin <= 4.2.0 - Broken Access Control vulnerability	Jan 2, 2025 1y ago
CVE-2023-45271	medium	4.3/10	WordPress ProductX – Gutenberg WooCommerce Blocks plugin <= 2.7.8 - Broken Access Control vulnerability	Jan 2, 2025 1y ago
CVE-2023-45101	medium	4.3/10	WordPress Customer Reviews for WooCommerce plugin <= 5.36.0 - Broken Access Control vulnerability	Jan 2, 2025 1y ago
CVE-2024-56207	high	8.8/10	WordPress EditionGuard for WooCommerce – eBook Sales with DRM plugin <= 3.4.2 - CSRF to Privilege Escalation vulnerability	Dec 31, 2024 1y ago
CVE-2024-56228	high	7.1/10	WordPress Wishlist for WooCommerce: Multi Wishlists Per Customer plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56265	high	7.1/10	WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) vulnerability	Dec 31, 2024 1y ago
CVE-2024-56230	high	7.5/10	WordPress Dynamic Product Category Grid, Slider for WooCommerce plugin <= 1.1.3 - Local File Inclusion vulnerability	Dec 31, 2024 1y ago
CVE-2024-11842	—	—	DN Shipping by Weight for WooCommerce < 1.2 - Settings Update via CSRF	Dec 27, 2024 1y ago
CVE-2024-11281	critical	9.8/10	WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change	Dec 25, 2024 1y ago
CVE-2024-12413	medium	5.3/10	MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.0.00 - Missing Authorization	Dec 25, 2024 1y ago
CVE-2024-12032	medium	6.5/10	Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin \| WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection	Dec 25, 2024 1y ago
CVE-2024-12210	medium	4.3/10	Print Invoice & Delivery Notes for WooCommerce <= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletion	Dec 24, 2024 1y ago