Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,720

All time

Critical · Active

11,011

CVSS ≥ 9.0

New · 14 days

2,897

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1441–1470 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-30511	medium	5.3/10	WordPress FG PrestaShop to WooCommerce plugin <= 4.45.1 - Sensitive Data Exposure via Log File vulnerability	Mar 29, 2024 2y ago
CVE-2024-30458	medium	4.3/10	WordPress FOX – Currency Switcher Professional for WooCommerce plugin <= 1.4.1.7 - Cross Site Request Forgery (CSRF) vulnerability	Mar 29, 2024 2y ago
CVE-2024-3061	high	7.2/10	HUSKY – Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion	Mar 29, 2024 2y ago
CVE-2024-0609	high	7.2/10	WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting	Mar 29, 2024 2y ago
CVE-2024-0608	medium	6.5/10	WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL Injection	Mar 29, 2024 2y ago
CVE-2024-27999	high	7.1/10	WordPress Preview E-mails for WooCommerce plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 28, 2024 2y ago
CVE-2023-52231	medium	6.5/10	WordPress Booster Plus for WooCommerce plugin < 7.1.2 - Auth. Sensitive Data Exposure vulnerability	Mar 28, 2024 2y ago
CVE-2023-52234	medium	6.5/10	WordPress Booster Elite for WooCommerce plugin < 7.1.2 - Auth. Sensitive Data Exposure vulnerability	Mar 28, 2024 2y ago
CVE-2024-30230	high	8.2/10	WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerability	Mar 28, 2024 2y ago
CVE-2023-44999	medium	5.4/10	WordPress WooCommerce Stripe Gateway plugin <= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerability	Mar 27, 2024 2y ago
CVE-2024-29760	high	7.1/10	WordPress Booster for WooCommerce plugin <= 7.1.8 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 27, 2024 2y ago
CVE-2024-29805	high	7.1/10	WordPress Shipping with Venipak for WooCommerce plugin <= 1.19.5 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 27, 2024 2y ago
CVE-2024-22288	high	7.1/10	WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.4.0 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 27, 2024 2y ago
CVE-2024-24800	high	7.1/10	WordPress Product Feed PRO for WooCommerce plugin <= 13.2.5 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 27, 2024 2y ago
CVE-2024-30231	critical	9.1/10	WordPress Product Import Export for WooCommerce plugin <= 2.4.1 - Arbitrary File Upload vulnerability	Mar 26, 2024 2y ago
CVE-2024-24711	medium	4.3/10	WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability	Mar 26, 2024 2y ago
CVE-2024-24799	medium	6.5/10	WordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerability	Mar 26, 2024 2y ago
CVE-2023-27608	medium	6.5/10	WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Broken Access Control vulnerability	Mar 25, 2024 2y ago
CVE-2024-2025	high	8.8/10	BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request	Mar 23, 2024 2y ago
CVE-2024-1697	medium	6.4/10	Custom WooCommerce Checkout Fields Editor <= 1.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting	Mar 23, 2024 2y ago
CVE-2024-0957	medium	6.1/10	WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting	Mar 22, 2024 2y ago
CVE-2022-44633	medium	6.5/10	WordPress YITH WooCommerce Gift Cards Premium plugin <= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerability	Mar 21, 2024 2y ago
CVE-2023-27607	medium	5.4/10	WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Settings Change vulnerability	Mar 21, 2024 2y ago
CVE-2024-2580	medium	6.5/10	WordPress Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability	Mar 21, 2024 2y ago
CVE-2024-27969	medium	6.5/10	WordPress Free Downloads WooCommerce plugin <= 3.5.8.2 - Cross Site Scripting (XSS) vulnerability	Mar 21, 2024 2y ago
CVE-2024-27994	high	7.1/10	WordPress YITH WooCommerce Product Add-Ons plugin <= 4.5.0 - Cross Site Scripting (XSS) vulnerability	Mar 21, 2024 2y ago
CVE-2024-1325	medium	4.3/10	Live Sales Notification for Woocommerce – Woomotiv <= 3.4.3 - Cross-Site Request Forgery via ajax_cancel_review	Mar 20, 2024 2y ago
CVE-2024-1205	high	8.8/10	Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload	Mar 20, 2024 2y ago
CVE-2024-1119	medium	5.3/10	Order Tip for WooCommerce <= 1.3.1 - Missing Authorization to Unauthenticated Data Export	Mar 20, 2024 2y ago
CVE-2024-2384	medium	4.3/10	WooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure	Mar 20, 2024 2y ago