Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,466

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,090

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1231–1260 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-9156	—	—	TI WooCommerce Wishlist <= 2.8.2 - Unauthenticated SQL Injection via lang parameters	Oct 10, 2024 1y ago
CVE-2024-9377	medium	6.1/10	Products, Order & Customers Export for WooCommerce <= 2.0.15 - Reflected Cross-Site Scripting	Oct 10, 2024 1y ago
CVE-2024-9205	medium	6.1/10	Maximum Products per User for WooCommerce <= 4.2.8 - Reflected Cross-Site Scripting	Oct 10, 2024 1y ago
CVE-2024-8629	medium	6.1/10	WooCommerce Multilingual & Multicurrency with WPML <= 5.3.7 - Reflected Cross-Site Scripting	Oct 8, 2024 1y ago
CVE-2024-47350	critical	9.3/10	WordPress YITH WooCommerce Ajax Search plugin <= 2.8.0 - SQL Injection vulnerability	Oct 6, 2024 1y ago
CVE-2024-47367	high	7.1/10	WordPress YITH WooCommerce Product Add-Ons plugin <= 4.13.0 - Reflected Cross Site Scripting (XSS) vulnerability	Oct 6, 2024 1y ago
CVE-2024-47395	high	7.1/10	WordPress Robokassa payment gateway for Woocommerce plugin <= 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerability	Oct 5, 2024 1y ago
CVE-2024-47309	medium	6.6/10	WordPress Cities Shipping Zones for WooCommerce plugin <= 1.2.7 - Local File Inclusion vulnerability	Oct 5, 2024 1y ago
CVE-2024-8499	medium	4.7/10	Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting via render_review_request_notice	Oct 4, 2024 1y ago
CVE-2024-9384	medium	6.1/10	Quantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 3.8.0 - Reflected Cross-Site Scripting	Oct 4, 2024 1y ago
CVE-2024-9345	medium	6.1/10	Product Delivery Date for WooCommerce – Lite <= 2.7.3 - Reflected Cross-Site Scripting	Oct 4, 2024 1y ago
CVE-2024-8254	medium	5.4/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution	Oct 2, 2024 1y ago
CVE-2024-9289	critical	9.8/10	WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation	Oct 1, 2024 1y ago
CVE-2024-8793	medium	6.1/10	Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More <= 2.7.2.1 - Reflected Cross-Site Scripting	Oct 1, 2024 1y ago
CVE-2024-9189	medium	5.3/10	EU/UK VAT Manager for WooCommerce <= 2.12.12 - Missing Authorization	Sep 28, 2024 1y ago
CVE-2024-8788	medium	6.1/10	EU/UK VAT Manager for WooCommerce <= 2.12.12 - Reflected Cross-Site Scripting	Sep 28, 2024 1y ago
CVE-2024-8922	high	8.8/10	Product Enquiry for WooCommerce <= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry_detail.php	Sep 27, 2024 1y ago
CVE-2024-8771	medium	4.3/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure	Sep 26, 2024 1y ago
CVE-2024-8872	medium	6.1/10	Store Hours for WooCommerce <= 4.3.20 - Reflected Cross-Site Scripting	Sep 26, 2024 1y ago
CVE-2024-8290	high	8.8/10	WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation	Sep 25, 2024 1y ago
CVE-2024-8678	medium	5.3/10	Revolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update	Sep 25, 2024 1y ago
CVE-2024-8658	medium	5.3/10	myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade	Sep 25, 2024 1y ago
CVE-2024-8668	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Sep 25, 2024 1y ago
CVE-2024-7491	medium	5.3/10	HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe	Sep 25, 2024 1y ago
CVE-2024-8716	medium	6.1/10	XT Ajax Add To Cart for WooCommerce <= 1.1.2 - Reflected Cross-Site Scripting	Sep 24, 2024 1y ago
CVE-2024-7846	—	—	YITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSS	Sep 23, 2024 1y ago
CVE-2024-44048	medium	6.5/10	WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability	Sep 23, 2024 1y ago
CVE-2024-45459	high	7.1/10	WordPress Product Slider for WooCommerce by PickPlugins plugin <= 1.13.50 - Reflected Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 1y ago
CVE-2024-8724	medium	6.1/10	Waitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site Scripting	Sep 14, 2024 1y ago
CVE-2024-8271	high	7.3/10	FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution	Sep 14, 2024 1y ago