Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,746

All time

Critical · Active

11,013

CVSS ≥ 9.0

New · 14 days

2,907

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1501–1530 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-1468	high	8.8/10	Avada \| Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload	Feb 29, 2024 2y ago
CVE-2023-51692	medium	4.3/10	WordPress Customer Reviews for WooCommerce Plugin <= 5.38.1 is vulnerable to Broken Access Control	Feb 28, 2024 2y ago
CVE-2023-52223	medium	5.4/10	WordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-25930	medium	4.3/10	WordPress Custom Order Statuses for WooCommerce Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 28, 2024 2y ago
CVE-2024-0767	medium	4.3/10	Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_plugin_activation	Feb 28, 2024 2y ago
CVE-2024-0766	medium	4.3/10	Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_request	Feb 28, 2024 2y ago
CVE-2024-1954	medium	6.3/10	Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.1.8 - Cross-Site Request Forgery	Feb 28, 2024 2y ago
CVE-2024-0431	medium	4.3/10	Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_set_default_card	Feb 28, 2024 2y ago
CVE-2024-0432	medium	4.3/10	Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_delete_card	Feb 28, 2024 2y ago
CVE-2024-0768	medium	4.3/10	Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_theme_activation	Feb 28, 2024 2y ago
CVE-2024-0433	medium	4.3/10	Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_unset_default_card	Feb 28, 2024 2y ago
CVE-2024-1698	critical	9.8/10	NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection	Feb 27, 2024 2y ago
CVE-2024-1687	medium	5.4/10	Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution	Feb 27, 2024 2y ago
CVE-2024-1686	medium	4.3/10	Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export	Feb 27, 2024 2y ago
CVE-2024-1436	medium	5.3/10	WordPress WooCommerce Coupon Popup, SmartBar, Slide In \| MyShopKit Plugin <= 1.0.9 is vulnerable to Sensitive Data Exposure	Feb 26, 2024 2y ago
CVE-2024-25925	critical	10.0/10	WordPress WooCommerce Easy Checkout Field Editor, Fees & Discounts Plugin <= 3.5.12 is vulnerable to Arbitrary File Upload	Feb 26, 2024 2y ago
CVE-2024-1758	medium	5.4/10	SuperFaktura WooCommerce <= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery	Feb 24, 2024 2y ago
CVE-2024-1562	medium	5.3/10	WooCommerce Google Sheet Connector <= 1.3.11 - Missing Authorization	Feb 21, 2024 2y ago
CVE-2024-1171	medium	5.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery	Feb 20, 2024 2y ago
CVE-2024-1172	medium	5.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion	Feb 20, 2024 2y ago
CVE-2024-0821	medium	6.1/10	Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-1054	medium	6.4/10	Booster for WooCommerce <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-0702	high	7.3/10	Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing Authorization	Feb 20, 2024 2y ago
CVE-2024-1276	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-1044	medium	5.3/10	Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review	Feb 20, 2024 2y ago
CVE-2024-1236	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-0610	critical	9.8/10	Piraeus Bank WooCommerce Payment Gateway <= 1.6.5.1 - Unauthenticated SQL Injection	Feb 17, 2024 2y ago
CVE-2024-23512	high	8.7/10	WordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-24796	high	8.2/10	WordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2023-51480	medium	6.5/10	WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago