Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,466

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,090

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1321–1350 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-6172	critical	9.8/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe	Jul 2, 2024 2y ago
CVE-2024-5192	medium	6.4/10	Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload	Jun 29, 2024 2y ago
CVE-2024-6288	medium	4.7/10	Conversios.io - All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce <= 7.1.0 - Reflected Cross-Site Scripting	Jun 28, 2024 2y ago
CVE-2024-4983	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 27, 2024 2y ago
CVE-2024-5431	high	8.8/10	WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode	Jun 25, 2024 2y ago
CVE-2024-5346	medium	6.4/10	Flatsome \| Multi-Purpose Responsive WooCommerce Theme <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes	Jun 22, 2024 2y ago
CVE-2024-6027	critical	9.8/10	Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter	Jun 21, 2024 2y ago
CVE-2024-5455	high	8.8/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion	Jun 21, 2024 2y ago
CVE-2024-1639	medium	6.5/10	License Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure	Jun 21, 2024 2y ago
CVE-2023-37872	medium	6.5/10	WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.5 - Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2023-37870	high	8.1/10	WordPress WooCommerce Warranty Requests plugin <= 2.1.9 - Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2023-35049	high	7.5/10	WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2023-47681	medium	6.5/10	WordPress WooCommerce Checkout Manager plugin <= 7.3.0 - Broken Access Control vulnerability	Jun 19, 2024 2y ago
CVE-2024-4632	medium	6.4/10	WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 19, 2024 2y ago
CVE-2024-5768	medium	6.4/10	MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 19, 2024 2y ago
CVE-2024-5871	critical	9.8/10	WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection	Jun 15, 2024 2y ago
CVE-2024-5868	medium	6.5/10	WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness	Jun 15, 2024 2y ago
CVE-2024-6000	high	7.1/10	FooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload	Jun 15, 2024 2y ago
CVE-2023-51495	medium	6.5/10	WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability	Jun 14, 2024 2y ago
CVE-2023-51496	medium	5.3/10	WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability	Jun 14, 2024 2y ago
CVE-2023-51497	medium	5.4/10	WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.9 - Broken Access Control vulnerability	Jun 14, 2024 2y ago
CVE-2023-51523	medium	4.3/10	WordPress WooCommerce Easy Duplicate Product plugin <= 0.3.0.7 - Broken Access Control vulnerability	Jun 14, 2024 2y ago
CVE-2023-29174	medium	6.5/10	WordPress SKU Label Changer For WooCommerce plugin <= 3.0 - Broken Access Control vulnerability	Jun 13, 2024 2y ago
CVE-2024-4371	critical	9.0/10	CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Unauthenticated PHP Object Injection	Jun 13, 2024 2y ago
CVE-2024-37297	medium	5.4/10	WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms	Jun 12, 2024 2y ago
CVE-2023-41240	medium	5.3/10	WordPress Pricing Deals for WooCommercePricing Deals for WooCommerce plugin <= 2.0.3.2 - Broken Access Control vulnerability	Jun 12, 2024 2y ago
CVE-2023-51679	medium	5.4/10	WordPress BulkGate SMS Plugin for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability	Jun 12, 2024 2y ago
CVE-2023-51680	medium	4.3/10	WordPress Quotes for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability	Jun 12, 2024 2y ago
CVE-2024-4564	medium	6.4/10	CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Jun 12, 2024 2y ago
CVE-2024-34763	medium	5.3/10	WordPress Builder for WooCommerce reviews shortcodes – ReviewShort plugin <= 1.01.5 - Broken Access Control vulnerability	Jun 11, 2024 2y ago