Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,466

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,090

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1261–1290 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-3459	medium	5.3/10	WooCommerce Multiple Free Gift <= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding	Sep 14, 2024 1y ago
CVE-2024-5567	medium	6.4/10	Betheme \| Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File	Sep 13, 2024 1y ago
CVE-2024-8277	critical	9.8/10	WooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation	Sep 11, 2024 1y ago
CVE-2024-8440	medium	6.4/10	Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget	Sep 11, 2024 1y ago
CVE-2024-8289	critical	9.8/10	MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover	Sep 4, 2024 1y ago
CVE-2024-3998	medium	6.4/10	Betheme \| Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Aug 30, 2024 2y ago
CVE-2024-43960	medium	5.9/10	WordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability	Aug 29, 2024 2y ago
CVE-2024-43943	high	8.5/10	WordPress Greenshift Woocommerce Addon plugin < 1.9.8 - Subscriber+ SQL Injection vulnerability	Aug 29, 2024 2y ago
CVE-2024-43917	critical	9.3/10	WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability	Aug 29, 2024 2y ago
CVE-2024-43132	critical	9.3/10	WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated SQL Injection vulnerability	Aug 29, 2024 2y ago
CVE-2024-8030	critical	9.8/10	Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.0.3 - Unauthenticated PHP Object Injection	Aug 28, 2024 2y ago
CVE-2024-43316	medium	4.3/10	WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability	Aug 26, 2024 2y ago
CVE-2024-43259	medium	5.3/10	WordPress Order Export for WooCommerce plugin <= 3.23 - Sensitive Data Exposure vulnerability	Aug 26, 2024 2y ago
CVE-2024-7258	high	8.8/10	WooCommerce Google Feed Manager <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Deletion	Aug 23, 2024 2y ago
CVE-2024-5583	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings	Aug 22, 2024 2y ago
CVE-2024-5335	critical	9.8/10	Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injection	Aug 21, 2024 2y ago
CVE-2024-5763	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget	Aug 20, 2024 2y ago
CVE-2024-43271	high	8.5/10	WordPress Widgets for WooCommerce Products on Elementor plugin <= 2.0.0 - Local File Inclusion vulnerability	Aug 19, 2024 2y ago
CVE-2024-43315	high	7.5/10	WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Insecure Direct Object References (IDOR) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43292	medium	5.9/10	WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.16 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-39666	medium	5.9/10	WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43342	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43138	medium	6.5/10	WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerability	Aug 13, 2024 2y ago
CVE-2024-43131	high	7.5/10	WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated Arbitrary Post/Page Deletion vulnerability	Aug 13, 2024 2y ago
CVE-2024-43128	medium	6.5/10	WordPress WooCommerce Product Table Lite plugin <= 3.5.1 - Arbitrary Code Execution vulnerability	Aug 13, 2024 2y ago
CVE-2024-39651	high	8.6/10	WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability	Aug 13, 2024 2y ago
CVE-2024-38747	high	7.5/10	WordPress HitPay Payment Gateway for WooCommerce plugin <= 4.1.3 - Sensitive Data Exposure via Log File vulnerability	Aug 13, 2024 2y ago
CVE-2024-38699	high	7.5/10	WordPress Wallet System for WooCommerce plugin <= 2.5.13 - Sensitive Data Exposure via Exported File vulnerability	Aug 13, 2024 2y ago
CVE-2024-37935	high	7.5/10	WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Sensitive Data Exposure vulnerability	Aug 13, 2024 2y ago
CVE-2024-7092	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter	Aug 13, 2024 2y ago