Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,529

All time

Critical · Active

12,232

CVSS ≥ 9.0

New · 14 days

3,105

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1621–1650 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-22147	high	7.6/10	WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.7.5 is vulnerable to SQL Injection	Jan 26, 2024 2y ago
CVE-2024-0617	medium	5.3/10	Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount()	Jan 25, 2024 2y ago
CVE-2024-22135	high	8.0/10	WordPress Order Export & Order Import for WooCommerce Plugin <= 2.4.3 is vulnerable to Arbitrary File Upload	Jan 24, 2024 2y ago
CVE-2024-22152	high	8.0/10	WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File Upload	Jan 24, 2024 2y ago
CVE-2023-6626	—	—	Product Enquiry for WooCommerce < 3.1 - Admin+ Stored XSS	Jan 22, 2024 2y ago
CVE-2023-6625	—	—	Product Enquiry for WooCommerce < 3.1 - Arbitrary Enquiry Deletion via CSRF	Jan 22, 2024 2y ago
CVE-2024-0705	critical	9.8/10	Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection	Jan 19, 2024 2y ago
CVE-2022-40702	medium	5.4/10	WordPress Advanced Local Pickup for WooCommerce Plugin <= 1.5.2 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2023-34379	medium	5.4/10	WordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-40203	medium	6.3/10	WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.1.5 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2022-38141	medium	4.3/10	WordPress Sales Report Email for WooCommerce Plugin <= 2.8 is vulnerable to Broken Access Control	Jan 17, 2024 2y ago
CVE-2023-7151	—	—	Product Enquiry for WooCommerce < 3.2 - Reflected XSS	Jan 16, 2024 2y ago
CVE-2023-4703	—	—	All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation	Jan 16, 2024 2y ago
CVE-2023-0479	—	—	Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS	Jan 16, 2024 2y ago
CVE-2023-0079	—	—	Customer Reviews for WooCommerce < 5.17.0 - Contributor+ Stored XSS	Jan 16, 2024 2y ago
CVE-2022-0775	—	—	WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion	Jan 16, 2024 2y ago
CVE-2022-1563	—	—	WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure	Jan 16, 2024 2y ago
CVE-2021-24566	—	—	WooCommerce Currency Switcher < 1.3.7 - Authenticated (Low Privilege) Local File Inclusion	Jan 16, 2024 2y ago
CVE-2023-6556	medium	5.4/10	FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting	Jan 11, 2024 2y ago
CVE-2023-6979	high	8.8/10	Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload	Jan 11, 2024 2y ago
CVE-2023-5957	—	—	Ni Purchase Order(PO) For WooCommerce <= 1.2.1 - Admin+ File Upload to Remote Code Execution	Jan 8, 2024 2y ago
CVE-2023-52222	medium	4.3/10	WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 8, 2024 2y ago
CVE-2023-52218	critical	10.0/10	WordPress WooCommerce Tranzila Gateway Plugin <= 1.0.8 is vulnerable to PHP Object Injection	Jan 8, 2024 2y ago
CVE-2024-21745	medium	6.5/10	WordPress Laybuy Payment Extension for WooCommerce Plugin <= 5.3.9 is vulnerable to Cross Site Scripting (XSS)	Jan 8, 2024 2y ago
CVE-2023-51678	medium	4.3/10	WordPress Doofinder for WooCommerce Plugin <= 2.0.33 is vulnerable to Broken Access Control	Jan 5, 2024 2y ago
CVE-2023-52127	medium	4.3/10	WordPress WPC Product Bundles for WooCommerce Plugin <= 7.3.1 is vulnerable to Cross Site Request Forgery (CSRF)	Jan 5, 2024 2y ago
CVE-2023-51502	high	7.5/10	WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)	Jan 5, 2024 2y ago
CVE-2023-7044	medium	6.4/10	Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Jan 4, 2024 2y ago
CVE-2024-0201	medium	5.4/10	Product Expiry for WooCommerce <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update	Jan 3, 2024 2y ago
CVE-2023-7068	medium	4.3/10	WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order Export	Jan 3, 2024 2y ago