Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,279

All time

Critical · Active

12,446

CVSS ≥ 9.0

New · 14 days

1,134

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1291–1320 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-5335	critical	9.8/10	Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injection	Aug 21, 2024 2y ago
CVE-2024-5763	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget	Aug 20, 2024 2y ago
CVE-2024-43271	high	8.5/10	WordPress Widgets for WooCommerce Products on Elementor plugin <= 2.0.0 - Local File Inclusion vulnerability	Aug 19, 2024 2y ago
CVE-2024-43315	high	7.5/10	WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Insecure Direct Object References (IDOR) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43292	medium	5.9/10	WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.16 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-39666	medium	5.9/10	WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43342	medium	6.5/10	WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability	Aug 18, 2024 2y ago
CVE-2024-43138	medium	6.5/10	WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerability	Aug 13, 2024 2y ago
CVE-2024-43131	high	7.5/10	WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated Arbitrary Post/Page Deletion vulnerability	Aug 13, 2024 2y ago
CVE-2024-43128	medium	6.5/10	WordPress WooCommerce Product Table Lite plugin <= 3.5.1 - Arbitrary Code Execution vulnerability	Aug 13, 2024 2y ago
CVE-2024-39651	high	8.6/10	WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability	Aug 13, 2024 2y ago
CVE-2024-38747	high	7.5/10	WordPress HitPay Payment Gateway for WooCommerce plugin <= 4.1.3 - Sensitive Data Exposure via Log File vulnerability	Aug 13, 2024 2y ago
CVE-2024-38699	high	7.5/10	WordPress Wallet System for WooCommerce plugin <= 2.5.13 - Sensitive Data Exposure via Exported File vulnerability	Aug 13, 2024 2y ago
CVE-2024-37935	high	7.5/10	WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Sensitive Data Exposure vulnerability	Aug 13, 2024 2y ago
CVE-2024-7092	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter	Aug 13, 2024 2y ago
CVE-2024-43126	high	7.1/10	WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.6.14 - Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-43127	high	7.1/10	WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.11 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 12, 2024 2y ago
CVE-2024-7503	critical	9.8/10	WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover	Aug 10, 2024 2y ago
CVE-2024-7257	critical	9.8/10	YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function	Aug 3, 2024 2y ago
CVE-2024-39652	high	7.1/10	WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability	Aug 1, 2024 2y ago
CVE-2024-38772	medium	6.5/10	WordPress JetWidgets for Elementor and WooCommerce plugin <= 1.1.7 - Contributor+ Limited Local File Inclusion vulnerability	Aug 1, 2024 2y ago
CVE-2024-6346	medium	6.4/10	Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget	Aug 1, 2024 2y ago
CVE-2024-3983	—	—	WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF	Aug 1, 2024 2y ago
CVE-2024-2843	—	—	WooCommerce Customers Manager < 30.1 - User Deletion via CSRF	Aug 1, 2024 2y ago
CVE-2024-1747	—	—	WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS	Aug 1, 2024 2y ago
CVE-2024-7027	high	7.3/10	WooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher Vendor	Jul 24, 2024 2y ago
CVE-2024-37217	medium	6.5/10	WordPress Empty Cart Button for WooCommerce plugin <= 1.3.8 - Cross Site Scripting (XSS) vulnerability	Jul 22, 2024 2y ago
CVE-2024-37509	high	7.1/10	WordPress MakeCommerce for WooCommerce plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 21, 2024 2y ago
CVE-2024-37515	medium	5.8/10	WordPress XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability	Jul 21, 2024 2y ago
CVE-2024-37522	medium	5.9/10	WordPress CC & BCC for Woocommerce Order Emails plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability	Jul 21, 2024 2y ago