Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

339,693

All time

Critical · Active

10,849

CVSS ≥ 9.0

New · 14 days

2,590

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 121–150 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-3504	medium	5.3/10	Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint	May 2, 2026 2mo ago
CVE-2026-2554	high	8.1/10	WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion	May 2, 2026 2mo ago
CVE-2026-6447	medium	4.4/10	Call for Price for WooCommerce <= 4.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings	May 2, 2026 2mo ago
CVE-2026-6725	medium	6.4/10	WPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute	Apr 28, 2026 2mo ago
CVE-2026-28040	medium	6.5/10	WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability	Apr 23, 2026 2mo ago
CVE-2026-4140	medium	4.3/10	Ni WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action	Apr 22, 2026 2mo ago
CVE-2026-3355	medium	6.1/10	Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch'	Apr 16, 2026 3mo ago
CVE-2026-5050	high	7.5/10	Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation	Apr 16, 2026 3mo ago
CVE-2026-6370	medium	5.9/10	WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability	Apr 15, 2026 3mo ago
CVE-2026-2582	medium	6.5/10	Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution	Apr 14, 2026 3mo ago
CVE-2026-4479	medium	4.4/10	WholeSale Products Dynamic Pricing Management WooCommerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings	Apr 14, 2026 3mo ago
CVE-2026-3830	—	—	Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLi	Apr 13, 2026 3mo ago
CVE-2026-4432	—	—	YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR	Apr 10, 2026 3mo ago
CVE-2026-4664	medium	5.3/10	Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter	Apr 10, 2026 3mo ago
CVE-2026-3574	medium	4.4/10	Experto Dashboard for WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' Setting	Apr 9, 2026 3mo ago
CVE-2026-3396	high	7.5/10	WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection	Apr 8, 2026 3mo ago
CVE-2026-1672	medium	6.5/10	BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification	Apr 8, 2026 3mo ago
CVE-2026-1673	medium	4.3/10	BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion	Apr 8, 2026 3mo ago
CVE-2026-39671	high	7.1/10	WordPress Extra Fees Plugin for WooCommerce plugin <= 4.3.3 - Cross Site Request Forgery (CSRF) vulnerability	Apr 8, 2026 3mo ago
CVE-2026-39668	medium	5.3/10	WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability	Apr 8, 2026 3mo ago
CVE-2026-39662	medium	5.3/10	WordPress Product Price by Formula for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability	Apr 8, 2026 3mo ago
CVE-2026-39656	medium	5.3/10	WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability	Apr 8, 2026 3mo ago
CVE-2026-39645	medium	5.4/10	WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability	Apr 8, 2026 3mo ago
CVE-2026-39643	medium	5.3/10	WordPress Payment Plugins for PayPal WooCommerce plugin <= 2.0.13 - Broken Access Control vulnerability	Apr 8, 2026 3mo ago
CVE-2026-39542	medium	5.3/10	WordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerability	Apr 8, 2026 3mo ago
CVE-2026-39508	medium	6.5/10	WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1.1 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2026 3mo ago
CVE-2026-2838	medium	4.4/10	Whole Enquiry Cart for WooCommerce <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole_success_msg' Parameter	Apr 8, 2026 3mo ago
CVE-2026-3311	medium	6.4/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar	Apr 8, 2026 3mo ago
CVE-2026-3499	high	8.8/10	Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions	Apr 8, 2026 3mo ago
CVE-2026-4896	high	8.1/10	WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation	Apr 4, 2026 3mo ago