Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,464

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,088

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 1201–1230 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-50510	critical	10.0/10	WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability	Oct 30, 2024 1y ago
CVE-2024-50509	high	8.6/10	WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerability	Oct 30, 2024 1y ago
CVE-2024-50421	medium	5.3/10	WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 3.8.6 - Broken Access Control vulnerability	Oct 29, 2024 1y ago
CVE-2024-49640	high	7.1/10	WordPress ACL Floating Cart for WooCommerce plugin <= 0.9 - Reflected Cross Site Scripting (XSS) vulnerability	Oct 29, 2024 1y ago
CVE-2024-49651	high	7.1/10	WordPress WooCommerce Maintenance Mode plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Oct 29, 2024 1y ago
CVE-2024-10233	medium	6.4/10	SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode	Oct 29, 2024 1y ago
CVE-2024-10437	medium	4.3/10	WPC Smart Messages for WooCommerce <= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation	Oct 29, 2024 1y ago
CVE-2024-10436	high	8.8/10	WPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion	Oct 29, 2024 1y ago
CVE-2024-50482	critical	10.0/10	WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability	Oct 29, 2024 1y ago
CVE-2024-50494	critical	10.0/10	WordPress Sudan Payment Gateway for WooCommerce plugin <= 1.2.2 - Arbitrary File Upload vulnerability	Oct 29, 2024 1y ago
CVE-2024-50447	medium	6.5/10	WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.19 - Cross Site Scripting (XSS) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50448	high	7.1/10	WordPress YITH WooCommerce Product Add-Ons plugin <= 4.14.1 - Reflected Cross Site Scripting (XSS) vulnerability	Oct 28, 2024 1y ago
CVE-2024-50479	critical	9.3/10	WordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerability	Oct 28, 2024 1y ago
CVE-2024-50416	high	8.8/10	WordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.6 - PHP Object Injection vulnerability	Oct 28, 2024 1y ago
CVE-2024-9214	medium	6.1/10	Extra Product Options Builder for WooCommerce <= 1.2.133 - Unauthenticated Stored Cross-Site Scripting	Oct 24, 2024 1y ago
CVE-2024-8667	medium	4.3/10	HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication	Oct 24, 2024 1y ago
CVE-2024-9531	medium	4.3/10	MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending	Oct 24, 2024 1y ago
CVE-2024-49658	critical	9.9/10	WordPress Woocommerce Custom Profile Picture plugin <= 1.0 - Arbitrary File Upload vulnerability	Oct 23, 2024 1y ago
CVE-2024-47328	high	7.6/10	WordPress Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin <= 3.1.2 - SQL Injection vulnerability	Oct 21, 2024 1y ago
CVE-2024-44061	high	7.1/10	WordPress EU/UK VAT Manager for WooCommerce plugin <= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerability	Oct 20, 2024 1y ago
CVE-2024-10049	medium	6.1/10	Edit WooCommerce Templates <= 1.1.2 - Reflected Cross-Site Scripting via page	Oct 18, 2024 1y ago
CVE-2024-49288	medium	5.9/10	WordPress Email Template Customizer for WooCommerce plugin <= 1.2.9.1 - Cross Site Scripting (XSS) vulnerability	Oct 17, 2024 1y ago
CVE-2024-49244	high	8.5/10	WordPress SV Product Import Export for WooCommerce plugin <= 1.0.0 - SQL Injection vulnerability	Oct 17, 2024 1y ago
CVE-2024-49305	critical	9.3/10	WordPress Customer Email Verification for WooCommerce plugin <= 2.8.10 - SQL Injection vulnerability	Oct 17, 2024 1y ago
CVE-2024-48047	medium	4.3/10	WordPress Linked Variation for WooCommerce plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability	Oct 17, 2024 1y ago
CVE-2024-9213	medium	6.1/10	Persian WooCommerce SMS <= 7.0.2 - Reflected Cross-Site Scripting	Oct 17, 2024 1y ago
CVE-2020-36841	medium	5.3/10	WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation	Oct 16, 2024 1y ago
CVE-2020-36834	medium	6.3/10	Discount Rules for WooCommerce <= 2.0.2 - Missing Authorization	Oct 16, 2024 1y ago
CVE-2024-8541	medium	4.7/10	Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons <= 2.6.5 - Reflected Cross-Site Scripting	Oct 16, 2024 1y ago
CVE-2024-8913	medium	4.3/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content_template	Oct 11, 2024 1y ago