Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,708

All time

Critical · Active

11,011

CVSS ≥ 9.0

New · 14 days

2,926

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1291–1320 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-32814	medium	5.3/10	WordPress Advanced Local Pickup for WooCommerce plugin <= 1.6.1 - Broken Access Control vulnerability	Jun 9, 2024 2y ago
CVE-2024-31267	medium	4.3/10	WordPress Flexible Checkout Fields for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability	Jun 9, 2024 2y ago
CVE-2024-30470	medium	6.5/10	WordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerability	Jun 9, 2024 2y ago
CVE-2024-30466	medium	5.4/10	WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.4 - Broken Access Control vulnerability	Jun 9, 2024 2y ago
CVE-2024-25929	medium	6.5/10	WordPress Product Catalog Mode For Woocommerce plugin <= 5.0.5 - Broken Access Control vulnerability	Jun 9, 2024 2y ago
CVE-2023-34003	medium	6.5/10	WordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerability	Jun 9, 2024 2y ago
CVE-2023-51494	medium	5.3/10	WordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerability	Jun 9, 2024 2y ago
CVE-2023-52230	medium	6.5/10	WordPress Booster Plus for WooCommerce plugin < 7.1.3 - Authenticated Arbitrary WordPress Option Disclosure Vulnerability	Jun 9, 2024 2y ago
CVE-2023-52232	medium	6.5/10	WordPress Booster Plus for WooCommerce plugin < 7.1.2 - Authenticated Arbitrary Post/Page Deletion Vulnerability	Jun 9, 2024 2y ago
CVE-2024-30537	medium	4.3/10	WordPress WPC Badge Management for WooCommerce plugin <= 2.4.0 - Broken Access Control vulnerability	Jun 9, 2024 2y ago
CVE-2024-31098	high	7.1/10	WordPress New Order Notification for Woocommerce plugin <= 2.0.2 - Broken Access Control vulnerability	Jun 9, 2024 2y ago
CVE-2024-35698	medium	5.9/10	WordPress YITH WooCommerce Tab Manager plugin <= 1.35.0 - Cross Site Scripting (XSS) vulnerability	Jun 8, 2024 2y ago
CVE-2024-35730	high	7.1/10	WordPress Active Products Tables for WooCommerce plugin <= 1.0.6.3 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 8, 2024 2y ago
CVE-2024-35733	high	7.1/10	WordPress Auto Coupons for WooCommerce plugin <= 3.0.14 - Reflected Cross Site Scripting (XSS) vulnerability	Jun 8, 2024 2y ago
CVE-2024-4042	medium	6.4/10	Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute	Jun 7, 2024 2y ago
CVE-2024-5612	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal Widget	Jun 7, 2024 2y ago
CVE-2024-1988	medium	6.4/10	Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 7, 2024 2y ago
CVE-2024-1689	medium	4.3/10	WooCommerce Tools <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivation	Jun 7, 2024 2y ago
CVE-2024-5188	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 6, 2024 2y ago
CVE-2024-5259	medium	6.4/10	MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution <= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter	Jun 6, 2024 2y ago
CVE-2024-5665	medium	4.3/10	Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure	Jun 6, 2024 2y ago
CVE-2024-4608	medium	6.4/10	SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	Jun 6, 2024 2y ago
CVE-2024-35634	medium	4.9/10	Woocommerce – Recent Purchases plugin <= 1.0.1 - File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2024-33628	high	8.8/10	WordPress XforWooCommerce plugin <= 2.0.2 - Authenticated Local File Inclusion vulnerability	Jun 4, 2024 2y ago
CVE-2023-51511	medium	6.5/10	WordPress Booster Elite for WooCommerce plugin < 7.1.3 - Authenticated Production Creation/Modification Vulnerability	Jun 4, 2024 2y ago
CVE-2023-48747	medium	6.5/10	WordPress Booster for WooCommerce plugin <= 7.1.2 - Authenticated Production Creation/Modification Vulnerability	Jun 4, 2024 2y ago
CVE-2024-2382	medium	5.3/10	Authorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass	Jun 4, 2024 2y ago
CVE-2024-1718	medium	5.3/10	Claudio Sanches – Checkout Cielo for WooCommerce <= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status Update	Jun 4, 2024 2y ago
CVE-2024-4552	critical	9.8/10	Social Login Lite For WooCommerce <= 1.6.0 - Authentication Bypass	Jun 4, 2024 2y ago
CVE-2024-34385	medium	5.9/10	WordPress YITH WooCommerce Wishlist plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability	Jun 3, 2024 2y ago