Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,279

All time

Critical · Active

12,446

CVSS ≥ 9.0

New · 14 days

1,134

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1261–1290 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-8788	medium	6.1/10	EU/UK VAT Manager for WooCommerce <= 2.12.12 - Reflected Cross-Site Scripting	Sep 28, 2024 1y ago
CVE-2024-8922	high	8.8/10	Product Enquiry for WooCommerce <= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry_detail.php	Sep 27, 2024 1y ago
CVE-2024-8771	medium	4.3/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure	Sep 26, 2024 1y ago
CVE-2024-8872	medium	6.1/10	Store Hours for WooCommerce <= 4.3.20 - Reflected Cross-Site Scripting	Sep 26, 2024 1y ago
CVE-2024-8290	high	8.8/10	WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation	Sep 25, 2024 1y ago
CVE-2024-8678	medium	5.3/10	Revolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update	Sep 25, 2024 1y ago
CVE-2024-8658	medium	5.3/10	myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade	Sep 25, 2024 1y ago
CVE-2024-8668	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	Sep 25, 2024 1y ago
CVE-2024-7491	medium	5.3/10	HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe	Sep 25, 2024 1y ago
CVE-2024-8716	medium	6.1/10	XT Ajax Add To Cart for WooCommerce <= 1.1.2 - Reflected Cross-Site Scripting	Sep 24, 2024 1y ago
CVE-2024-7846	—	—	YITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSS	Sep 23, 2024 1y ago
CVE-2024-44048	medium	6.5/10	WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability	Sep 23, 2024 1y ago
CVE-2024-45459	high	7.1/10	WordPress Product Slider for WooCommerce by PickPlugins plugin <= 1.13.50 - Reflected Cross Site Scripting (XSS) vulnerability	Sep 15, 2024 2y ago
CVE-2024-8724	medium	6.1/10	Waitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site Scripting	Sep 14, 2024 2y ago
CVE-2024-8271	high	7.3/10	FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution	Sep 14, 2024 2y ago
CVE-2022-3459	medium	5.3/10	WooCommerce Multiple Free Gift <= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding	Sep 14, 2024 2y ago
CVE-2024-5567	medium	6.4/10	Betheme \| Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File	Sep 13, 2024 2y ago
CVE-2024-8277	critical	9.8/10	WooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation	Sep 11, 2024 2y ago
CVE-2024-8440	medium	6.4/10	Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget	Sep 11, 2024 2y ago
CVE-2024-8289	critical	9.8/10	MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover	Sep 4, 2024 2y ago
CVE-2024-3998	medium	6.4/10	Betheme \| Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Aug 30, 2024 2y ago
CVE-2024-43960	medium	5.9/10	WordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability	Aug 29, 2024 2y ago
CVE-2024-43943	high	8.5/10	WordPress Greenshift Woocommerce Addon plugin < 1.9.8 - Subscriber+ SQL Injection vulnerability	Aug 29, 2024 2y ago
CVE-2024-43917	critical	9.3/10	WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability	Aug 29, 2024 2y ago
CVE-2024-43132	critical	9.3/10	WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated SQL Injection vulnerability	Aug 29, 2024 2y ago
CVE-2024-8030	critical	9.8/10	Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.0.3 - Unauthenticated PHP Object Injection	Aug 28, 2024 2y ago
CVE-2024-43316	medium	4.3/10	WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability	Aug 26, 2024 2y ago
CVE-2024-43259	medium	5.3/10	WordPress Order Export for WooCommerce plugin <= 3.23 - Sensitive Data Exposure vulnerability	Aug 26, 2024 2y ago
CVE-2024-7258	high	8.8/10	WooCommerce Google Feed Manager <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Deletion	Aug 23, 2024 2y ago
CVE-2024-5583	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings	Aug 22, 2024 2y ago