Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,899

All time

Critical · Active

11,029

CVSS ≥ 9.0

New · 14 days

3,057

Newly disclosed

Feed last synced

49 mins ago

Data freshness

Showing 1531–1560 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-1276	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-1044	medium	5.3/10	Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review	Feb 20, 2024 2y ago
CVE-2024-1236	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 20, 2024 2y ago
CVE-2024-0610	critical	9.8/10	Piraeus Bank WooCommerce Payment Gateway <= 1.6.5.1 - Unauthenticated SQL Injection	Feb 17, 2024 2y ago
CVE-2024-23512	high	8.7/10	WordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2024-24796	high	8.2/10	WordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object Injection	Feb 12, 2024 2y ago
CVE-2023-51480	medium	6.5/10	WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2023-51485	medium	6.5/10	WordPress Pay with Vipps for WooCommerce Plugin <= 1.14.13 is vulnerable to Cross Site Scripting (XSS)	Feb 10, 2024 2y ago
CVE-2024-1122	medium	5.3/10	Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export	Feb 9, 2024 2y ago
CVE-2024-24878	high	7.1/10	WordPress Portugal CTT Tracking for WooCommerce plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 8, 2024 2y ago
CVE-2024-24885	medium	5.9/10	WordPress Woocommerce Vietnam Checkout Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-24886	medium	5.9/10	WordPress Product Labels For Woocommerce Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)	Feb 8, 2024 2y ago
CVE-2024-0586	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritping	Feb 5, 2024 2y ago
CVE-2024-0954	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting	Feb 5, 2024 2y ago
CVE-2024-0796	medium	4.3/10	Active Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Cross-Site Request Forgery	Feb 5, 2024 2y ago
CVE-2024-0585	medium	5.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl	Feb 5, 2024 2y ago
CVE-2024-0797	medium	4.3/10	Active Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Missing Authorization	Feb 5, 2024 2y ago
CVE-2024-24841	medium	5.9/10	WordPress Add Customer for WooCommerce Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)	Feb 5, 2024 2y ago
CVE-2023-51669	medium	6.5/10	WordPress Product Code for WooCommerce Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)	Feb 1, 2024 2y ago
CVE-2024-22153	medium	5.9/10	WordPress Stock Locations for WooCommerce Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS)	Jan 31, 2024 2y ago
CVE-2023-6278	—	—	Biteship for WooCommerce < 2.2.25 - Reflected Cross-Site Scripting	Jan 29, 2024 2y ago
CVE-2024-22147	high	7.6/10	WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.7.5 is vulnerable to SQL Injection	Jan 26, 2024 2y ago
CVE-2024-0617	medium	5.3/10	Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount()	Jan 25, 2024 2y ago
CVE-2024-22135	high	8.0/10	WordPress Order Export & Order Import for WooCommerce Plugin <= 2.4.3 is vulnerable to Arbitrary File Upload	Jan 24, 2024 2y ago
CVE-2024-22152	high	8.0/10	WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File Upload	Jan 24, 2024 2y ago
CVE-2023-6626	—	—	Product Enquiry for WooCommerce < 3.1 - Admin+ Stored XSS	Jan 22, 2024 2y ago
CVE-2023-6625	—	—	Product Enquiry for WooCommerce < 3.1 - Arbitrary Enquiry Deletion via CSRF	Jan 22, 2024 2y ago
CVE-2024-0705	critical	9.8/10	Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection	Jan 19, 2024 2y ago
CVE-2022-40702	medium	5.4/10	WordPress Advanced Local Pickup for WooCommerce Plugin <= 1.5.2 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2023-34379	medium	5.4/10	WordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago