Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,292

All time

Critical · Active

12,448

CVSS ≥ 9.0

New · 14 days

1,113

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1441–1470 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-4448	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table'	May 10, 2024 2y ago
CVE-2024-4038	medium	6.5/10	Back In Stock Notifier for WooCommerce \| WooCommerce Waitlist Pro <= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution	May 9, 2024 2y ago
CVE-2024-4606	medium	5.4/10	WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder plugin <= 2.0.3 - PHP Object Injection vulnerability	May 9, 2024 2y ago
CVE-2024-32807	high	8.5/10	WordPress Brevo for WooCommerce plugin <= 4.0.17 - Arbitrary File Download and Deletion vulnerability	May 6, 2024 2y ago
CVE-2024-2752	medium	5.5/10	Where Did You Hear About Us Checkout Field for WooCommerce <= 1.3.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-1679	medium	6.4/10	Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Templates	May 2, 2024 2y ago
CVE-2024-0629	medium	5.3/10	2Checkout Payment Gateway for WooCommerce <= 6.2 - Missing Authorization via sniff_ins	May 2, 2024 2y ago
CVE-2024-1173	high	7.2/10	WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injection	May 2, 2024 2y ago
CVE-2024-1677	medium	6.3/10	Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Improper Authorization	May 2, 2024 2y ago
CVE-2024-3991	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id	May 2, 2024 2y ago
CVE-2024-3734	medium	6.5/10	FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.8 - Unauthenticated Arbitrary Shortcode Execution	May 2, 2024 2y ago
CVE-2024-3045	high	7.2/10	PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-3728	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle	May 2, 2024 2y ago
CVE-2024-4156	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-4003	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 2, 2024 2y ago
CVE-2024-3047	high	7.2/10	PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery	May 2, 2024 2y ago
CVE-2024-3957	medium	6.5/10	Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution	May 2, 2024 2y ago
CVE-2024-33949	medium	6.5/10	WordPress Min and Max Purchase for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33944	medium	6.5/10	WordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerability	May 2, 2024 2y ago
CVE-2024-33956	medium	4.3/10	WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Broken Access Control vulnerability	May 2, 2024 2y ago
CVE-2024-4185	high	8.1/10	Customer Email Verification for WooCommerce <= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient Randomness	Apr 30, 2024 2y ago
CVE-2024-33585	medium	4.3/10	WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 2.12.1 - Broken Access Control vulnerability	Apr 29, 2024 2y ago
CVE-2024-2838	medium	6.4/10	WPC Composite Products for WooCommerce <= 7.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting	Apr 27, 2024 2y ago
CVE-2024-32828	medium	4.3/10	WordPress Table Rate Shipping Method for WooCommerce by Flexible Shipping plugin <= 4.24.15 - Broken Access Control vulnerability	Apr 26, 2024 2y ago
CVE-2024-3962	critical	9.8/10	Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file	Apr 26, 2024 2y ago
CVE-2024-31266	critical	9.1/10	WordPress Advanced Order Export For WooCommerce plugin <= 3.4.4 - Remote Code Execution (RCE) vulnerability	Apr 25, 2024 2y ago
CVE-2024-3733	medium	5.3/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Information Exposure	Apr 25, 2024 2y ago
CVE-2024-32675	medium	6.5/10	WordPress Order Limit for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability	Apr 24, 2024 2y ago
CVE-2024-32678	medium	5.3/10	WordPress TrackShip for WooCommerce plugin <= 1.7.5 - Broken Access Control vulnerability	Apr 24, 2024 2y ago
CVE-2024-32699	medium	4.3/10	WordPress YITH WooCommerce Compare plugin <= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago