Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,466

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,090

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1291–1320 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-43126	high	7.1/10	WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.6.14 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-43127	high	7.1/10	WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.11 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-7503	critical	9.8/10	WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover	Aug 10, 2024 2y ago
CVE-2024-7257	critical	9.8/10	YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function	Aug 3, 2024 2y ago
CVE-2024-39652	high	7.1/10	WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-38772	medium	6.5/10	WordPress JetWidgets for Elementor and WooCommerce plugin <= 1.1.7 - Contributor+ Limited Local File Inclusion vulnerability	Aug 1, 2024 2y ago
CVE-2024-6346	medium	6.4/10	Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget	Aug 1, 2024 2y ago
CVE-2024-3983	—	—	WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF	Aug 1, 2024 2y ago
CVE-2024-2843	—	—	WooCommerce Customers Manager < 30.1 - User Deletion via CSRF	Aug 1, 2024 2y ago
CVE-2024-1747	—	—	WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS	Aug 1, 2024 2y ago
CVE-2024-7027	high	7.3/10	WooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher Vendor	Jul 24, 2024 2y ago
CVE-2024-37217	medium	6.5/10	WordPress Empty Cart Button for WooCommerce plugin <= 1.3.8 - Cross Site Scripting (XSS) vulnerability	Jul 22, 2024 2y ago
CVE-2024-37509	high	7.1/10	WordPress MakeCommerce for WooCommerce plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 21, 2024 2y ago
CVE-2024-37515	medium	5.8/10	WordPress XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability	Jul 21, 2024 2y ago
CVE-2024-37522	medium	5.9/10	WordPress CC & BCC for Woocommerce Order Emails plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability	Jul 21, 2024 2y ago
CVE-2024-37943	medium	5.8/10	WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 20, 2024 2y ago
CVE-2024-38669	high	7.1/10	WordPress Predictive Search for WooCommerce plugin <= 6.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 20, 2024 2y ago
CVE-2024-38683	high	7.1/10	WordPress WooCommerce Report plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 20, 2024 2y ago
CVE-2024-3934	medium	6.5/10	Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download	Jul 20, 2024 2y ago
CVE-2024-2691	medium	6.4/10	WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode	Jul 16, 2024 2y ago
CVE-2024-3964	—	—	Product Enquiry for WooCommerce < 3.1.8 - Admin+ Stored XSS	Jul 13, 2024 2y ago
CVE-2024-37932	high	8.6/10	WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Arbitrary File Deletion vulnerability	Jul 12, 2024 2y ago
CVE-2024-37202	medium	6.5/10	WordPress Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter plugin <= 1.222.17 - Broken Access Control to XSS vulnerability	Jul 12, 2024 2y ago
CVE-2024-37544	medium	4.3/10	WordPress Get Better Reviews for WooCommerce plugin <= 4.0.6 - Broken Access Control vulnerability	Jul 12, 2024 2y ago
CVE-2024-37933	critical	9.3/10	WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated SQL Injection vulnerability	Jul 12, 2024 2y ago
CVE-2024-6353	high	8.8/10	Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'	Jul 12, 2024 2y ago
CVE-2024-37520	medium	6.5/10	WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion vulnerability	Jul 9, 2024 2y ago
CVE-2024-35777	low	3.5/10	WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability	Jul 9, 2024 2y ago
CVE-2024-5669	medium	6.4/10	XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting	Jul 9, 2024 2y ago
CVE-2024-5704	medium	4.3/10	XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update	Jul 9, 2024 2y ago