Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

355,839

All time

Critical · Active

12,696

CVSS ≥ 9.0

New · 14 days

2,189

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1381–1410 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-5871	critical	9.8/10	WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection	Jun 15, 2024 2y ago
CVE-2024-5868	medium	6.5/10	WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness	Jun 15, 2024 2y ago
CVE-2024-6000	high	7.1/10	FooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload	Jun 15, 2024 2y ago
CVE-2023-51495	medium	6.5/10	WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability	Jun 14, 2024 2y ago
CVE-2023-51496	medium	5.3/10	WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability	Jun 14, 2024 2y ago
CVE-2023-51497	medium	5.4/10	WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.9 - Broken Access Control vulnerability	Jun 14, 2024 2y ago
CVE-2023-51523	medium	4.3/10	WordPress WooCommerce Easy Duplicate Product plugin <= 0.3.0.7 - Broken Access Control vulnerability	Jun 14, 2024 2y ago
CVE-2023-29174	medium	6.5/10	WordPress SKU Label Changer For WooCommerce plugin <= 3.0 - Broken Access Control vulnerability	Jun 13, 2024 2y ago
CVE-2024-4371	critical	9.0/10	CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Unauthenticated PHP Object Injection	Jun 13, 2024 2y ago
CVE-2024-37297	medium	5.4/10	WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms	Jun 12, 2024 2y ago
CVE-2023-41240	medium	5.3/10	WordPress Pricing Deals for WooCommercePricing Deals for WooCommerce plugin <= 2.0.3.2 - Broken Access Control vulnerability	Jun 12, 2024 2y ago
CVE-2023-51679	medium	5.4/10	WordPress BulkGate SMS Plugin for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability	Jun 12, 2024 2y ago
CVE-2023-51680	medium	4.3/10	WordPress Quotes for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability	Jun 12, 2024 2y ago
CVE-2024-4564	medium	6.4/10	CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Jun 12, 2024 2y ago
CVE-2024-34763	medium	5.3/10	WordPress Builder for WooCommerce reviews shortcodes – ReviewShort plugin <= 1.01.5 - Broken Access Control vulnerability	Jun 11, 2024 2y ago
CVE-2023-52227	medium	4.3/10	WordPress MailerLite – WooCommerce integration plugin <= 2.0.8 - Broken Access Control vulnerability	Jun 11, 2024 2y ago
CVE-2023-52224	medium	4.3/10	WordPress Revolut Gateway for WooCommerce plugin <= 4.9.7 - Broken Access Control vulnerability	Jun 11, 2024 2y ago
CVE-2024-34819	medium	5.3/10	WordPress MC Woocommerce Wishlist plugin <= 1.7.2 - Broken Access Control vulnerability	Jun 11, 2024 2y ago
CVE-2023-51498	medium	5.3/10	WordPress WooCommerce Canada Post Shipping plugin <= 2.8.3 - Broken Access Control vulnerability	Jun 11, 2024 2y ago
CVE-2024-5189	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jun 11, 2024 2y ago
CVE-2023-52179	medium	5.4/10	WordPress Product Expiry for WooCommerce plugin <= 2.5 - Broken Access Control vulnerability	Jun 11, 2024 2y ago
CVE-2024-34813	medium	5.3/10	WordPress WooCommerce Wishlist plugin <= 1.7.8 - Broken Access Control vulnerability	Jun 11, 2024 2y ago
CVE-2023-52217	medium	4.3/10	WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability	Jun 11, 2024 2y ago
CVE-2023-52186	medium	5.3/10	WordPress WooCommerce Product Vendors plugin <= 2.2.2 - Unauthenticated Broken Access Control vulnerability	Jun 11, 2024 2y ago
CVE-2024-5530	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget	Jun 11, 2024 2y ago
CVE-2024-35728	medium	5.3/10	WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerability	Jun 10, 2024 2y ago
CVE-2024-35680	medium	5.3/10	WordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerability	Jun 10, 2024 2y ago
CVE-2024-35658	high	8.6/10	WordPress Checkout Field Editor for WooCommerce (Pro) plugin <= 3.6.2 - Unauthenticated Arbitrary File Deletion vulnerability	Jun 10, 2024 2y ago
CVE-2024-35724	medium	4.3/10	WordPress Bosa Elementor Addons and Templates for WooCommerce plugin <= 1.0.12 - Broken Access Control vulnerability	Jun 10, 2024 2y ago
CVE-2024-35727	medium	4.3/10	WordPress Extra Product Options for WooCommerce plugin <= 3.0.6 - Broken Access Control vulnerability	Jun 10, 2024 2y ago