Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,899

All time

Critical · Active

11,029

CVSS ≥ 9.0

New · 14 days

3,052

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1561–1590 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-40203	medium	6.3/10	WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.1.5 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-38141	medium	4.3/10	WordPress Sales Report Email for WooCommerce Plugin <= 2.8 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2023-7151	—	—	Product Enquiry for WooCommerce < 3.2 - Reflected XSS	Jan 16, 2024 2y ago
CVE-2023-4703	—	—	All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation	Jan 16, 2024 2y ago
CVE-2023-0479	—	—	Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS	Jan 16, 2024 2y ago
CVE-2023-0079	—	—	Customer Reviews for WooCommerce < 5.17.0 - Contributor+ Stored XSS	Jan 16, 2024 2y ago
CVE-2022-0775	—	—	WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion	Jan 16, 2024 2y ago
CVE-2022-1563	—	—	WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure	Jan 16, 2024 2y ago
CVE-2021-24566	—	—	WooCommerce Currency Switcher < 1.3.7 - Authenticated (Low Privilege) Local File Inclusion	Jan 16, 2024 2y ago
CVE-2023-6556	medium	5.4/10	FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting	Jan 11, 2024 2y ago
CVE-2023-6979	high	8.8/10	Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload	Jan 11, 2024 2y ago
CVE-2023-5957	—	—	Ni Purchase Order(PO) For WooCommerce <= 1.2.1 - Admin+ File Upload to Remote Code Execution	Jan 8, 2024 2y ago
CVE-2023-52222	medium	4.3/10	WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 8, 2024 2y ago
CVE-2023-52218	critical	10.0/10	WordPress WooCommerce Tranzila Gateway Plugin <= 1.0.8 is vulnerable to PHP Object Injection	Jan 8, 2024 2y ago
CVE-2024-21745	medium	6.5/10	WordPress Laybuy Payment Extension for WooCommerce Plugin <= 5.3.9 is vulnerable to Cross Site Scripting (XSS)	Jan 8, 2024 2y ago
CVE-2023-51678	medium	4.3/10	WordPress Doofinder for WooCommerce Plugin <= 2.0.33 is vulnerable to Broken Access Control	Jan 5, 2024 2y ago
CVE-2023-52127	medium	4.3/10	WordPress WPC Product Bundles for WooCommerce Plugin <= 7.3.1 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-51502	high	7.5/10	WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)	Jan 5, 2024 2y ago
CVE-2023-7044	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jan 4, 2024 2y ago
CVE-2024-0201	medium	5.4/10	Product Expiry for WooCommerce <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update	Jan 3, 2024 2y ago
CVE-2023-7068	medium	4.3/10	WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order Export	Jan 3, 2024 2y ago
CVE-2023-51503	medium	5.9/10	WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR)	Dec 31, 2023 2y ago
CVE-2023-49777	critical	9.1/10	WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.3.0 is vulnerable to PHP Object Injection	Dec 31, 2023 2y ago
CVE-2023-51505	critical	10.0/10	WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to PHP Object Injection	Dec 29, 2023 2y ago
CVE-2023-50853	high	7.6/10	WordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.75.0 is vulnerable to SQL Injection	Dec 28, 2023 2y ago
CVE-2023-32795	high	8.2/10	WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection	Dec 28, 2023 2y ago
CVE-2023-32799	medium	6.5/10	WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR)	Dec 21, 2023 2y ago
CVE-2023-32747	medium	5.4/10	WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR)	Dec 21, 2023 2y ago
CVE-2023-50834	medium	6.5/10	WordPress WooCommerce Menu Extension Plugin <= 1.6.2 is vulnerable to Cross Site Scripting (XSS)	Dec 21, 2023 2y ago
CVE-2022-45377	medium	6.5/10	WordPress Drag and Drop Multiple File Upload for WooCommerce Plugin <= 1.0.8 is vulnerable to Multiple Vulnerabilities	Dec 21, 2023 2y ago