Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

355,856

All time

Critical · Active

12,700

CVSS ≥ 9.0

New · 14 days

2,181

Newly disclosed

Feed last synced

44 mins ago

Data freshness

Showing 1501–1530 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-32834	medium	5.9/10	WordPress WooCommerce Shipping Label plugin <= 2.3.8 - Cross Site Scripting (XSS) vulnerability	Apr 24, 2024 2y ago
CVE-2024-32781	high	7.5/10	WordPress Email Customizer for WooCommerce plugin <= 2.6.0 - Sensitive Data Exposure vulnerability	Apr 24, 2024 2y ago
CVE-2024-32803	medium	6.4/10	WordPress SuperFaktura WooCommerce plugin <= 1.40.3 - Server Side Request Forgery (SSRF) vulnerability	Apr 24, 2024 2y ago
CVE-2024-1756	—	—	WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure	Apr 24, 2024 2y ago
CVE-2024-1743	—	—	WooCommerce Customers Manager < 29.8 - Reflected XSS	Apr 24, 2024 2y ago
CVE-2024-32687	medium	4.3/10	WordPress WPC Frequently Bought Together for WooCommerce plugin <= 7.0.3 - Broken Access Control vulnerability	Apr 22, 2024 2y ago
CVE-2024-32691	medium	5.3/10	WordPress Active Products Tables for WooCommerce plugin <= 1.0.6.2 - Broken Access Control vulnerability	Apr 22, 2024 2y ago
CVE-2024-1057	medium	6.4/10	ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	Apr 20, 2024 2y ago
CVE-2024-3731	medium	6.1/10	Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's'	Apr 19, 2024 2y ago
CVE-2023-6892	medium	6.4/10	EAN for WooCommerce <= 4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta Shortcode	Apr 18, 2024 2y ago
CVE-2023-6897	medium	4.3/10	EAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode	Apr 18, 2024 2y ago
CVE-2024-32602	high	7.6/10	WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.3.1 - SQL Injection vulnerability	Apr 18, 2024 2y ago
CVE-2024-32585	medium	5.9/10	WordPress Import Content in WordPress & WooCommerce with Excel plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability	Apr 18, 2024 2y ago
CVE-2024-32513	medium	5.3/10	WordPress Product Feed PRO for WooCommerce plugin <= 13.3.1 - Sensitive Data Exposure vulnerability	Apr 17, 2024 2y ago
CVE-2024-32516	medium	4.3/10	WordPress Multi Currency For WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability	Apr 17, 2024 2y ago
CVE-2024-32517	medium	4.3/10	WordPress Custom Thank You Page Customize For WooCommerce by Binary Carpenter plugin <= 1.4.12 - Broken Access Control vulnerability	Apr 17, 2024 2y ago
CVE-2024-32519	medium	4.3/10	WordPress GG Woo Feed for WooCommerce plugin <= 1.2.6 - Broken Access Control vulnerability	Apr 17, 2024 2y ago
CVE-2024-32520	medium	4.3/10	WordPress WPC Grouped Product for WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability	Apr 17, 2024 2y ago
CVE-2024-32522	medium	4.3/10	WordPress Open Close WooCommerce Store plugin <= 4.9.1 - Broken Access Control vulnerability	Apr 17, 2024 2y ago
CVE-2024-32524	medium	4.3/10	WordPress Custom Order Statuses for WooCommerce plugin <= 1.5.2 - Broken Access Control vulnerability	Apr 17, 2024 2y ago
CVE-2024-3869	medium	4.3/10	Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search	Apr 16, 2024 2y ago
CVE-2024-3243	medium	4.3/10	Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending	Apr 16, 2024 2y ago
CVE-2024-3067	high	7.2/10	WooCommerce Google Feed Manager <= 2.4.2 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting	Apr 16, 2024 2y ago
CVE-2024-31431	medium	4.3/10	WordPress Product Input Fields for WooCommerce plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) vulnerability	Apr 15, 2024 2y ago
CVE-2024-31920	medium	4.3/10	WordPress Currency per Product for WooCommerce plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability	Apr 15, 2024 2y ago
CVE-2024-31940	medium	4.3/10	WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.104 - Cross Site Request Forgery (CSRF) vulnerability	Apr 15, 2024 2y ago
CVE-2024-32095	medium	4.3/10	WordPress MultiParcels Shipping For WooCommerce plugin < 1.16.9 - Cross Site Request Forgery (CSRF) vulnerability	Apr 15, 2024 2y ago
CVE-2024-32101	medium	4.3/10	WordPress Email Marketing for WooCommerce plugin <= 1.14.3 - Cross Site Request Forgery (CSRF) vulnerability	Apr 15, 2024 2y ago
CVE-2024-32434	medium	4.3/10	WordPress Order Delivery Date for WooCommerce plugin <= 3.20.2 - Cross Site Request Forgery (CSRF) vulnerability	Apr 15, 2024 2y ago
CVE-2024-32446	medium	5.4/10	WordPress Wallet System for WooCommerce plugin <= 2.5.9 - Cross Site Request Forgery (CSRF) vulnerability	Apr 15, 2024 2y ago