Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,565

All time

Critical · Active

11,006

CVSS ≥ 9.0

New · 14 days

2,950

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 991–1020 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-12266	medium	6.5/10	ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization	Dec 24, 2024 1y ago
CVE-2024-11938	medium	6.4/10	One Click Upsell Funnel for WooCommerce <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode	Dec 21, 2024 1y ago
CVE-2024-12721	high	7.2/10	Custom Product Tabs For WooCommerce <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection	Dec 21, 2024 1y ago
CVE-2024-11893	medium	6.4/10	Spoki – Chat Buttons and WooCommerce Notifications <= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 20, 2024 1y ago
CVE-2024-54383	critical	9.8/10	WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability	Dec 18, 2024 1y ago
CVE-2024-56008	high	7.5/10	WordPress Spreadr Woocommerce plugin <= 1.0.4 - Arbitrary Content Deletion vulnerability	Dec 18, 2024 1y ago
CVE-2024-12432	high	8.1/10	WPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key	Dec 18, 2024 1y ago
CVE-2024-12395	medium	6.1/10	WooCommerce Additional Fees On Checkout (Free) <= 1.4.7 - Reflected Cross-Site Scripting via 'number'	Dec 17, 2024 1y ago
CVE-2024-12220	medium	6.1/10	SMS for WooCommerce <= 2.8.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting	Dec 17, 2024 1y ago
CVE-2024-55996	medium	6.1/10	WordPress Payment gateway per Product for WooCommerce plugin <= 3.5.6 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-55992	medium	5.4/10	WordPress WooCommerce Basic Ordernumbers plugin <= 1.4.4 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-56009	medium	5.3/10	WordPress Spreadr Woocommerce plugin <= 1.0.4 - Broken Access Control vulnerability	Dec 16, 2024 1y ago
CVE-2024-12448	medium	6.4/10	Posts and Products Views for WooCommerce <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 14, 2024 1y ago
CVE-2024-12517	medium	6.4/10	WooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Dec 14, 2024 1y ago
CVE-2024-54333	high	7.1/10	WordPress Check Pincode For Woocommerce plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54328	high	7.1/10	WordPress Invoice Payment for WooCommerce plugin <= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54312	high	7.1/10	WordPress افزونه پیامک ووکامرس Persian WooCommerce SMS plugin <= 7.0.5 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54262	critical	9.9/10	WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability	Dec 13, 2024 1y ago
CVE-2024-54240	high	7.1/10	WordPress Blaze Online eParcel for WooCommerce plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54236	high	7.1/10	WordPress Ni WooCommerce Bulk Product Editor plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54235	high	7.1/10	WordPress Shiptimize for WooCommerce plugin <= 3.1.86 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2024-54231	high	7.1/10	WordPress Ni WooCommerce Order Export plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability	Dec 13, 2024 1y ago
CVE-2023-44149	medium	5.3/10	WordPress Brands for WooCommerce plugin <= 3.8.2.2 - Broken Access Control vulnerability	Dec 13, 2024 1y ago
CVE-2023-41803	medium	5.3/10	WordPress BitPay Checkout for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability	Dec 13, 2024 1y ago
CVE-2023-41686	medium	6.5/10	WordPress Woocommerce Support System plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability	Dec 13, 2024 1y ago
CVE-2023-41671	medium	5.4/10	WordPress Abandoned Cart Lite for WooCommerce plugin <= 5.16.1 - Cross Site Request Forgery (CSRF) vulnerability	Dec 13, 2024 1y ago
CVE-2023-41132	medium	4.3/10	WordPress Category Slider for WooCommerce plugin <= 1.4.15 - Broken Access Control vulnerability	Dec 13, 2024 1y ago
CVE-2023-37989	medium	5.4/10	WordPress Easyship WooCommerce Shipping Rates plugin <= 0.9.0 - Broken Access Control vulnerability	Dec 13, 2024 1y ago
CVE-2023-37971	medium	6.5/10	WordPress WooCommerce Product Stock Alert plugin <= 2.0.1 - Broken Access Control vulnerability	Dec 13, 2024 1y ago
CVE-2023-37969	medium	5.3/10	WordPress Checkout with Zelle on Woocommerce plugin <= 3.1 - Broken Access Control vulnerability	Dec 13, 2024 1y ago