Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,466

All time

Critical · Active

12,228

CVSS ≥ 9.0

New · 14 days

3,088

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1441–1470 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-3047	high	7.2/10	PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery	May 2, 2024 2y ago
CVE-2024-3957	medium	6.5/10	Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution	May 2, 2024 2y ago
CVE-2024-33949	medium	6.5/10	WordPress Min and Max Purchase for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability	May 2, 2024 2y ago
CVE-2024-33944	medium	6.5/10	WordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerability	May 2, 2024 2y ago
CVE-2024-33956	medium	4.3/10	WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Broken Access Control vulnerability	May 2, 2024 2y ago
CVE-2024-4185	high	8.1/10	Customer Email Verification for WooCommerce <= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient Randomness	Apr 30, 2024 2y ago
CVE-2024-33585	medium	4.3/10	WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 2.12.1 - Broken Access Control vulnerability	Apr 29, 2024 2y ago
CVE-2024-2838	medium	6.4/10	WPC Composite Products for WooCommerce <= 7.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting	Apr 27, 2024 2y ago
CVE-2024-32828	medium	4.3/10	WordPress Table Rate Shipping Method for WooCommerce by Flexible Shipping plugin <= 4.24.15 - Broken Access Control vulnerability	Apr 26, 2024 2y ago
CVE-2024-3962	critical	9.8/10	Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file	Apr 26, 2024 2y ago
CVE-2024-31266	critical	9.1/10	WordPress Advanced Order Export For WooCommerce plugin <= 3.4.4 - Remote Code Execution (RCE) vulnerability	Apr 25, 2024 2y ago
CVE-2024-3733	medium	5.3/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Information Exposure	Apr 25, 2024 2y ago
CVE-2024-32675	medium	6.5/10	WordPress Order Limit for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability	Apr 24, 2024 2y ago
CVE-2024-32678	medium	5.3/10	WordPress TrackShip for WooCommerce plugin <= 1.7.5 - Broken Access Control vulnerability	Apr 24, 2024 2y ago
CVE-2024-32699	medium	4.3/10	WordPress YITH WooCommerce Compare plugin <= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32834	medium	5.9/10	WordPress WooCommerce Shipping Label plugin <= 2.3.8 - Cross Site Scripting (XSS) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32781	high	7.5/10	WordPress Email Customizer for WooCommerce plugin <= 2.6.0 - Sensitive Data Exposure vulnerability	Apr 24, 2024 2y ago
CVE-2024-32803	medium	6.4/10	WordPress SuperFaktura WooCommerce plugin <= 1.40.3 - Server Side Request Forgery (SSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-1756	—	—	WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure	Apr 24, 2024 2y ago
CVE-2024-1743	—	—	WooCommerce Customers Manager < 29.8 - Reflected XSS	Apr 24, 2024 2y ago
CVE-2024-32687	medium	4.3/10	WordPress WPC Frequently Bought Together for WooCommerce plugin <= 7.0.3 - Broken Access Control vulnerability	Apr 22, 2024 2y ago
CVE-2024-32691	medium	5.3/10	WordPress Active Products Tables for WooCommerce plugin <= 1.0.6.2 - Broken Access Control vulnerability	Apr 22, 2024 2y ago
CVE-2024-1057	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 20, 2024 2y ago
CVE-2024-3731	medium	6.1/10	Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's'	Apr 19, 2024 2y ago
CVE-2023-6892	medium	6.4/10	EAN for WooCommerce <= 4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta Shortcode	Apr 18, 2024 2y ago
CVE-2023-6897	medium	4.3/10	EAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode	Apr 18, 2024 2y ago
CVE-2024-32602	high	7.6/10	WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.3.1 - SQL Injection vulnerability	Apr 18, 2024 2y ago
CVE-2024-32585	medium	5.9/10	WordPress Import Content in WordPress & WooCommerce with Excel plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability	Apr 18, 2024 2y ago
CVE-2024-32513	medium	5.3/10	WordPress Product Feed PRO for WooCommerce plugin <= 13.3.1 - Sensitive Data Exposure vulnerability	Apr 17, 2024 2y ago
CVE-2024-32516	medium	4.3/10	WordPress Multi Currency For WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability	Apr 17, 2024 2y ago