Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,677

All time

Critical · Active

11,008

CVSS ≥ 9.0

New · 14 days

3,008

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1081–1110 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-10486	medium	5.3/10	Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File	Nov 18, 2024 1y ago
CVE-2024-10614	medium	4.3/10	Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation	Nov 16, 2024 1y ago
CVE-2024-8873	medium	6.1/10	PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting	Nov 16, 2024 1y ago
CVE-2024-8979	high	8.0/10	Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation	Nov 15, 2024 1y ago
CVE-2024-8978	medium	5.7/10	Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure	Nov 15, 2024 1y ago
CVE-2024-8961	medium	6.4/10	Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Nov 15, 2024 1y ago
CVE-2024-9356	medium	6.1/10	Yotpo: Product & Photo Reviews for WooCommerce <= 1.7.9 - Reflected Cross-Site Scripting	Nov 15, 2024 1y ago
CVE-2024-52379	critical	10.0/10	WordPress kineticPay for WooCommerce plugin <= 2.0.8 - Arbitrary File Upload vulnerability	Nov 14, 2024 1y ago
CVE-2024-10820	critical	9.8/10	WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload	Nov 13, 2024 1y ago
CVE-2024-10828	high	8.1/10	Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details	Nov 13, 2024 1y ago
CVE-2024-10882	medium	6.1/10	Product Delivery Date for WooCommerce - Lite <= 2.8.0 - Reflected Cross-Site Scripting	Nov 13, 2024 1y ago
CVE-2024-10854	medium	4.3/10	Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import	Nov 13, 2024 1y ago
CVE-2024-10853	medium	4.3/10	Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order Deletion	Nov 13, 2024 1y ago
CVE-2024-10852	medium	4.3/10	Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Export	Nov 13, 2024 1y ago
CVE-2024-51693	high	7.1/10	WordPress Search order by product SKU for WooCommerce plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-10837	medium	6.1/10	SysBasics Customize My Account for WooCommerce <= 2.7.29 - Reflected Cross-Site Scripting via tab Parameter	Nov 9, 2024 1y ago
CVE-2024-10640	high	7.3/10	The FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution	Nov 9, 2024 1y ago
CVE-2024-51784	high	7.1/10	WordPress FriendStore for WooCommerce plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability	Nov 9, 2024 1y ago
CVE-2024-10627	critical	9.8/10	WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload	Nov 9, 2024 1y ago
CVE-2024-10626	high	8.8/10	WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion	Nov 9, 2024 1y ago
CVE-2024-10625	critical	9.8/10	WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion	Nov 9, 2024 1y ago
CVE-2024-10168	medium	6.4/10	Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode	Nov 6, 2024 1y ago
CVE-2024-10535	medium	5.3/10	Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion	Nov 6, 2024 1y ago
CVE-2024-9178	medium	6.4/10	XT Floating Cart for WooCommerce <= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	Nov 5, 2024 1y ago
CVE-2024-10711	high	8.8/10	WooCommerce Report <= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update	Nov 5, 2024 1y ago
CVE-2024-10114	high	8.1/10	Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider	Nov 5, 2024 1y ago
CVE-2024-51626	high	8.5/10	WordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerability	Nov 4, 2024 1y ago
CVE-2024-37201	medium	4.3/10	WordPress Woocommerce Customers Order History plugin <= 5.2.2 - Broken Access Control vulnerability	Nov 1, 2024 1y ago
CVE-2024-37203	medium	4.3/10	WordPress Laybuy Payment Extension for WooCommerce plugin <= 5.3.9 - Broken Access Control vulnerability	Nov 1, 2024 1y ago
CVE-2024-38702	medium	5.3/10	WordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.2 - Broken Access Control vulnerability	Nov 1, 2024 1y ago