Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,710

All time

Critical · Active

11,011

CVSS ≥ 9.0

New · 14 days

2,928

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1321–1350 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-5427	medium	6.4/10	WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form Shortcode	May 31, 2024 2y ago
CVE-2024-5341	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widget	May 30, 2024 2y ago
CVE-2024-5039	medium	6.4/10	HUSKY – Products Filter Professional for WooCommerce <= 1.3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	May 29, 2024 2y ago
CVE-2024-5086	medium	6.4/10	Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget	May 29, 2024 2y ago
CVE-2024-0434	medium	5.3/10	WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_save	May 29, 2024 2y ago
CVE-2024-4455	high	7.2/10	YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting	May 24, 2024 2y ago
CVE-2024-4484	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 24, 2024 2y ago
CVE-2024-4485	medium	6.4/10	The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 24, 2024 2y ago
CVE-2024-3626	medium	4.3/10	Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization	May 23, 2024 2y ago
CVE-2024-3155	medium	6.4/10	Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 21, 2024 2y ago
CVE-2024-32511	critical	9.8/10	WordPress Simple Registration for WooCommerce plugin <= 1.5.6 - Unauthenticated Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2024-27971	high	8.3/10	WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2023-51546	high	7.2/10	WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.2.1 - Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2023-51481	critical	9.8/10	WordPress Local Delivery Drivers for WooCommerce plugin <= 1.9.0 - Unauthenticated Account Takeover vulnerability	May 17, 2024 2y ago
CVE-2024-34370	high	7.2/10	WordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerability	May 17, 2024 2y ago
CVE-2023-35881	high	7.6/10	WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability	May 17, 2024 2y ago
CVE-2022-45070	medium	5.3/10	WordPress Conditional Checkout Fields for WooCommerce plugin <= 1.2.3 - Broken Authentication vulnerability	May 17, 2024 2y ago
CVE-2024-3609	medium	4.3/10	ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.27 - Missing Authorization	May 16, 2024 2y ago
CVE-2024-34751	medium	4.4/10	WordPress Order Export & Order Import for WooCommerce plugin <= 2.4.9 - PHP Object Injection vulnerability	May 16, 2024 2y ago
CVE-2024-4624	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 14, 2024 2y ago
CVE-2024-0870	medium	5.3/10	YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update	May 14, 2024 2y ago
CVE-2024-35167	medium	6.5/10	WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <=1.4.8 - Cross Site Scripting (XSS) vulnerability	May 13, 2024 2y ago
CVE-2024-4039	medium	6.5/10	Orders Tracking for WooCommerce <= 1.2.10 - Unauthenticated Arbitrary Shortcode Execution	May 10, 2024 2y ago
CVE-2024-4275	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles'	May 10, 2024 2y ago
CVE-2024-4448	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table'	May 10, 2024 2y ago
CVE-2024-4038	medium	6.5/10	Back In Stock Notifier for WooCommerce \| WooCommerce Waitlist Pro <= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution	May 9, 2024 2y ago
CVE-2024-4606	medium	5.4/10	WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder plugin <= 2.0.3 - PHP Object Injection vulnerability	May 9, 2024 2y ago
CVE-2024-32807	high	8.5/10	WordPress Brevo for WooCommerce plugin <= 4.0.17 - Arbitrary File Download and Deletion vulnerability	May 6, 2024 2y ago
CVE-2024-2752	medium	5.5/10	Where Did You Hear About Us Checkout Field for WooCommerce <= 1.3.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-1679	medium	6.4/10	Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Templates	May 2, 2024 2y ago