Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,283

All time

Critical · Active

12,447

CVSS ≥ 9.0

New · 14 days

1,105

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1321–1350 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-37943	medium	5.8/10	WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 20, 2024 2y ago
CVE-2024-38669	high	7.1/10	WordPress Predictive Search for WooCommerce plugin <= 6.0.1 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 20, 2024 2y ago
CVE-2024-38683	high	7.1/10	WordPress WooCommerce Report plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability	Jul 20, 2024 2y ago
CVE-2024-3934	medium	6.5/10	Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download	Jul 20, 2024 2y ago
CVE-2024-2691	medium	6.4/10	WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode	Jul 16, 2024 2y ago
CVE-2024-3964	—	—	Product Enquiry for WooCommerce < 3.1.8 - Admin+ Stored XSS	Jul 13, 2024 2y ago
CVE-2024-37932	high	8.6/10	WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Arbitrary File Deletion vulnerability	Jul 12, 2024 2y ago
CVE-2024-37202	medium	6.5/10	WordPress Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter plugin <= 1.222.17 - Broken Access Control to XSS vulnerability	Jul 12, 2024 2y ago
CVE-2024-37544	medium	4.3/10	WordPress Get Better Reviews for WooCommerce plugin <= 4.0.6 - Broken Access Control vulnerability	Jul 12, 2024 2y ago
CVE-2024-37933	critical	9.3/10	WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated SQL Injection vulnerability	Jul 12, 2024 2y ago
CVE-2024-6353	high	8.8/10	Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'	Jul 12, 2024 2y ago
CVE-2024-37520	medium	6.5/10	WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion vulnerability	Jul 9, 2024 2y ago
CVE-2024-35777	low	3.5/10	WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability	Jul 9, 2024 2y ago
CVE-2024-5669	medium	6.4/10	XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting	Jul 9, 2024 2y ago
CVE-2024-5704	medium	4.3/10	XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update	Jul 9, 2024 2y ago
CVE-2024-6172	critical	9.8/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe	Jul 2, 2024 2y ago
CVE-2024-5192	medium	6.4/10	Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload	Jun 29, 2024 2y ago
CVE-2024-6288	medium	4.7/10	Conversios.io - All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce <= 7.1.0 - Reflected Cross-Site Scripting	Jun 28, 2024 2y ago
CVE-2024-4983	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 27, 2024 2y ago
CVE-2024-5431	high	8.8/10	WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode	Jun 25, 2024 2y ago
CVE-2024-5346	medium	6.4/10	Flatsome \| Multi-Purpose Responsive WooCommerce Theme <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes	Jun 22, 2024 2y ago
CVE-2024-6027	critical	9.8/10	Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter	Jun 21, 2024 2y ago
CVE-2024-5455	high	8.8/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion	Jun 21, 2024 2y ago
CVE-2024-1639	medium	6.5/10	License Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure	Jun 21, 2024 2y ago
CVE-2023-37872	medium	6.5/10	WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.5 - Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2023-37870	high	8.1/10	WordPress WooCommerce Warranty Requests plugin <= 2.1.9 - Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2023-35049	high	7.5/10	WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2023-47681	medium	6.5/10	WordPress WooCommerce Checkout Manager plugin <= 7.3.0 - Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2024-4632	medium	6.4/10	WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 19, 2024 2y ago
CVE-2024-5768	medium	6.4/10	MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 19, 2024 2y ago