Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

340,985

All time

Critical · Active

11,041

CVSS ≥ 9.0

New · 14 days

3,050

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1711–1740 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-3365	—	—	MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion	Aug 7, 2023 2y ago
CVE-2023-37873	high	7.1/10	WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Scripting (XSS)	Aug 5, 2023 2y ago
CVE-2023-3508	—	—	WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF	Jul 31, 2023 2y ago
CVE-2023-3507	—	—	WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF	Jul 31, 2023 2y ago
CVE-2023-37894	high	7.1/10	WordPress Variation Images Gallery for WooCommerce Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)	Jul 27, 2023 2y ago
CVE-2023-37975	high	7.1/10	WordPress Variation Swatches for WooCommerce Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)	Jul 27, 2023 2y ago
CVE-2023-33925	high	7.1/10	WordPress WooCommerce Product Categories Selection Widget Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)	Jul 25, 2023 2y ago
CVE-2023-36383	medium	5.9/10	WordPress Event Manager for WooCommerce Plugin <= 3.9.5 is vulnerable to Cross Site Scripting (XSS)	Jul 18, 2023 3y ago
CVE-2023-36514	medium	6.5/10	WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Request Forgery (CSRF)	Jul 17, 2023 3y ago
CVE-2023-36511	medium	4.3/10	WordPress WooCommerce Order Barcodes Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF)	Jul 17, 2023 3y ago
CVE-2023-35880	medium	5.4/10	WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF)	Jul 17, 2023 3y ago
CVE-2023-2329	—	—	WooCommerce Google Sheet Connector < 1.3.6 - Access Code Update via CSRF	Jul 17, 2023 3y ago
CVE-2023-35091	medium	4.3/10	WordPress WooCommerce Stock Manager Plugin <= 2.10.0 is vulnerable to Cross Site Request Forgery (CSRF)	Jul 11, 2023 3y ago
CVE-2023-34015	medium	5.4/10	WordPress Advanced Flat rate shipping Woocommerce Plugin <= 1.6.4.4 is vulnerable to Cross Site Request Forgery (CSRF)	Jul 11, 2023 3y ago
CVE-2023-35912	medium	4.3/10	WordPress Potent Donations for WooCommerce Plugin <= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF)	Jul 10, 2023 3y ago
CVE-2020-36741	medium	4.3/10	MultiVendorX – MultiVendor Marketplace Solution For WooCommerce <= 3.5.7 - Cross-Site Request Forgery Bypass	Jul 1, 2023 3y ago
CVE-2020-36736	medium	4.3/10	WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 1.5.15 - Cross-Site Request Forgery Bypass	Jul 1, 2023 3y ago
CVE-2020-36735	medium	4.3/10	WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting <= 1.6.3 - Cross-Site Request Forgery Bypass	Jul 1, 2023 3y ago
CVE-2023-29423	medium	5.9/10	WordPress Cancel order request WooCommerce Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)	Jun 26, 2023 3y ago
CVE-2023-29093	medium	5.9/10	WordPress Conditional extra fees for woocommerce Plugin <= 1.0.96 is vulnerable to Cross Site Scripting (XSS)	Jun 26, 2023 3y ago
CVE-2023-28991	medium	5.9/10	WordPress Order date time for WooCommerce Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)	Jun 26, 2023 3y ago
CVE-2023-28988	medium	5.9/10	WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)	Jun 26, 2023 3y ago
CVE-2023-34170	medium	5.9/10	WordPress Quick/Bulk Order Form for WooCommerce Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)	Jun 22, 2023 3y ago
CVE-2023-35917	medium	4.3/10	WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)	Jun 22, 2023 3y ago
CVE-2023-35918	high	7.1/10	WordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)	Jun 22, 2023 3y ago
CVE-2019-25152	high	7.2/10	Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting	Jun 22, 2023 3y ago
CVE-2023-34000	high	7.5/10	WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)	Jun 14, 2023 3y ago
CVE-2023-2275	medium	4.3/10	WooCommerce Multivendor Marketplace – REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API	Jun 9, 2023 3y ago
CVE-2023-2986	critical	9.8/10	Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass	Jun 8, 2023 3y ago
CVE-2020-36731	high	7.2/10	Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update	Jun 7, 2023 3y ago