Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,705

All time

Critical · Active

11,011

CVSS ≥ 9.0

New · 14 days

2,944

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1201–1230 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-43342	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 1y ago
CVE-2024-43138	medium	6.5/10	WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerability	Aug 13, 2024 1y ago
CVE-2024-43131	high	7.5/10	WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated Arbitrary Post/Page Deletion vulnerability	Aug 13, 2024 1y ago
CVE-2024-43128	medium	6.5/10	WordPress WooCommerce Product Table Lite plugin <= 3.5.1 - Arbitrary Code Execution vulnerability	Aug 13, 2024 1y ago
CVE-2024-39651	high	8.6/10	WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability	Aug 13, 2024 1y ago
CVE-2024-38747	high	7.5/10	WordPress HitPay Payment Gateway for WooCommerce plugin <= 4.1.3 - Sensitive Data Exposure via Log File vulnerability	Aug 13, 2024 1y ago
CVE-2024-38699	high	7.5/10	WordPress Wallet System for WooCommerce plugin <= 2.5.13 - Sensitive Data Exposure via Exported File vulnerability	Aug 13, 2024 1y ago
CVE-2024-37935	high	7.5/10	WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Sensitive Data Exposure vulnerability	Aug 13, 2024 1y ago
CVE-2024-7092	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter	Aug 13, 2024 1y ago
CVE-2024-43126	high	7.1/10	WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.6.14 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-43127	high	7.1/10	WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.11 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 1y ago
CVE-2024-7503	critical	9.8/10	WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover	Aug 10, 2024 1y ago
CVE-2024-7257	critical	9.8/10	YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function	Aug 3, 2024 1y ago
CVE-2024-39652	high	7.1/10	WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 1y ago
CVE-2024-38772	medium	6.5/10	WordPress JetWidgets for Elementor and WooCommerce plugin <= 1.1.7 - Contributor+ Limited Local File Inclusion vulnerability	Aug 1, 2024 1y ago
CVE-2024-6346	medium	6.4/10	Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget	Aug 1, 2024 1y ago
CVE-2024-3983	—	—	WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF	Aug 1, 2024 1y ago
CVE-2024-2843	—	—	WooCommerce Customers Manager < 30.1 - User Deletion via CSRF	Aug 1, 2024 1y ago
CVE-2024-1747	—	—	WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS	Aug 1, 2024 1y ago
CVE-2024-7027	high	7.3/10	WooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher Vendor	Jul 24, 2024 1y ago
CVE-2024-37217	medium	6.5/10	WordPress Empty Cart Button for WooCommerce plugin <= 1.3.8 - Cross Site Scripting (XSS) vulnerability	Jul 22, 2024 2y ago
CVE-2024-37509	high	7.1/10	WordPress MakeCommerce for WooCommerce plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 21, 2024 2y ago
CVE-2024-37515	medium	5.8/10	WordPress XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability	Jul 21, 2024 2y ago
CVE-2024-37522	medium	5.9/10	WordPress CC & BCC for Woocommerce Order Emails plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability	Jul 21, 2024 2y ago
CVE-2024-37943	medium	5.8/10	WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 20, 2024 2y ago
CVE-2024-38669	high	7.1/10	WordPress Predictive Search for WooCommerce plugin <= 6.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 20, 2024 2y ago
CVE-2024-38683	high	7.1/10	WordPress WooCommerce Report plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 20, 2024 2y ago
CVE-2024-3934	medium	6.5/10	Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download	Jul 20, 2024 2y ago
CVE-2024-2691	medium	6.4/10	WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode	Jul 16, 2024 2y ago
CVE-2024-3964	—	—	Product Enquiry for WooCommerce < 3.1.8 - Admin+ Stored XSS	Jul 13, 2024 2y ago