Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,530

All time

Critical · Active

12,232

CVSS ≥ 9.0

New · 14 days

3,091

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1741–1770 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-39159	medium	4.3/10	WordPress Fraud Prevention For Woocommerce Plugin <= 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF)	Oct 3, 2023 2y ago
CVE-2023-40212	medium	4.3/10	WordPress WooCommerce Product Attachment Plugin <= 2.1.8 is vulnerable to Cross Site Request Forgery (CSRF)	Oct 3, 2023 2y ago
CVE-2023-44144	high	7.1/10	WordPress Dreamfox Media Payment gateway per Product for Woocommerce Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)	Oct 2, 2023 2y ago
CVE-2023-41691	high	7.1/10	WordPress WooCommerce PensoPay Plugin <= 6.3.1 is vulnerable to Cross Site Scripting (XSS)	Sep 29, 2023 2y ago
CVE-2023-5230	medium	6.4/10	TM WooCommerce Compare & Wishlist <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Sep 28, 2023 2y ago
CVE-2023-4423	medium	4.4/10	WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.37.1 - Authenticated (Admin+) Stored Cross-Site Scripting	Sep 27, 2023 2y ago
CVE-2023-3547	—	—	All in One B2B for WooCommerce <= 1.0.3 - Multiple CSRF	Sep 25, 2023 2y ago
CVE-2023-41874	high	7.1/10	WordPress Order Delivery Date for WooCommerce Plugin <= 3.20.0 is vulnerable to Cross Site Scripting (XSS)	Sep 25, 2023 2y ago
CVE-2023-4376	—	—	Serial Codes Generator and Validator with WooCommerce Support < 2.4.15 - Admin+ Stored XSS	Sep 19, 2023 2y ago
CVE-2023-4948	medium	4.3/10	WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update	Sep 14, 2023 2y ago
CVE-2023-4945	medium	6.4/10	Booster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	Sep 14, 2023 2y ago
CVE-2023-4216	—	—	Orders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/Read	Sep 4, 2023 2y ago
CVE-2023-32296	high	7.1/10	WordPress Kangu para WooCommerce Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS)	Sep 4, 2023 2y ago
CVE-2023-39162	high	7.1/10	WordPress User Email Verification for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)	Sep 4, 2023 2y ago
CVE-2023-3764	medium	4.3/10	WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery via Save	Aug 31, 2023 3y ago
CVE-2023-4160	medium	4.4/10	WooCommerce PDF Invoice Builder <= 1.2.90 - Authenticated (Administrator+) Cross-Site Scripting	Aug 31, 2023 3y ago
CVE-2023-3162	critical	9.8/10	Stripe Payment Plugin for WooCommerce <= 3.7.7 - Authentication Bypass	Aug 31, 2023 3y ago
CVE-2023-4161	medium	4.3/10	WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation	Aug 31, 2023 3y ago
CVE-2023-3677	high	8.8/10	WooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Export	Aug 31, 2023 3y ago
CVE-2023-4245	medium	4.3/10	WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure	Aug 31, 2023 3y ago
CVE-2023-28415	medium	5.9/10	WordPress Side Cart Woocommerce (Ajax) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 3y ago
CVE-2023-34004	medium	6.5/10	WordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 3y ago
CVE-2023-34184	high	7.1/10	WordPress Woocommerce Order address Print Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 3y ago
CVE-2023-33317	high	7.1/10	WordPress WooCommerce Warranty Requests Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 3y ago
CVE-2023-32746	medium	6.5/10	WordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 3y ago
CVE-2023-32793	medium	6.5/10	WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 3y ago
CVE-2023-32802	high	7.1/10	WordPress WooCommerce Pre-Orders Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 3y ago
CVE-2023-32801	high	7.1/10	WordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS)	Aug 30, 2023 3y ago
CVE-2023-32575	medium	5.9/10	WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.25 is vulnerable to Cross Site Scripting (XSS)	Aug 25, 2023 3y ago
CVE-2023-3366	—	—	MultiParcels Shipping For WooCommerce < 1.15.2 - Arbitrary Shipment Deletion via CSRF	Aug 21, 2023 3y ago