Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

339,703

All time

Critical · Active

10,851

CVSS ≥ 9.0

New · 14 days

2,582

Newly disclosed

Feed last synced

43 mins ago

Data freshness

Showing 151–180 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-15484	—	—	Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass	Apr 1, 2026 3mo ago
CVE-2026-32528	high	7.1/10	WordPress Riode \| Multi-Purpose WooCommerce theme < 1.6.29 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 25, 2026 3mo ago
CVE-2026-32526	high	7.1/10	WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability	Mar 25, 2026 3mo ago
CVE-2026-32522	high	8.6/10	WordPress WooCommerce Support Ticket System plugin < 18.5 - Arbitrary File Deletion vulnerability	Mar 25, 2026 3mo ago
CVE-2026-31921	high	8.2/10	WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability	Mar 25, 2026 3mo ago
CVE-2026-31920	critical	9.3/10	WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - SQL Injection vulnerability	Mar 25, 2026 3mo ago
CVE-2026-27045	high	8.8/10	WordPress WooCommerce Infinite Scroll plugin <= 1.6.2 - PHP Object Injection vulnerability	Mar 25, 2026 3mo ago
CVE-2026-25469	medium	6.5/10	WordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerability	Mar 25, 2026 3mo ago
CVE-2026-25455	medium	6.5/10	WordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerability	Mar 25, 2026 3mo ago
CVE-2026-25397	high	7.5/10	WordPress File Uploader for WooCommerce plugin <= 1.0.4 - Path Traversal vulnerability	Mar 25, 2026 3mo ago
CVE-2026-25396	high	7.5/10	WordPress Commerce Coinbase For WooCommerce plugin <= 1.6.6 - Broken Access Control vulnerability	Mar 25, 2026 3mo ago
CVE-2026-25328	medium	6.8/10	WordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerability	Mar 25, 2026 3mo ago
CVE-2026-25317	high	7.5/10	WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.9.0 - Broken Access Control vulnerability	Mar 25, 2026 3mo ago
CVE-2026-24993	critical	9.3/10	WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.3 - SQL Injection vulnerability	Mar 25, 2026 3mo ago
CVE-2026-24372	high	7.5/10	WordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability	Mar 25, 2026 3mo ago
CVE-2026-23977	high	7.5/10	WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability	Mar 25, 2026 3mo ago
CVE-2026-22480	high	7.2/10	WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability	Mar 25, 2026 3mo ago
CVE-2026-3138	medium	6.5/10	Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE	Mar 24, 2026 3mo ago
CVE-2026-4001	critical	9.8/10	Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula	Mar 23, 2026 3mo ago
CVE-2025-10734	medium	5.3/10	ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure	Mar 23, 2026 3mo ago
CVE-2025-10731	medium	5.3/10	ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data Export	Mar 23, 2026 3mo ago
CVE-2025-10679	high	7.3/10	ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution	Mar 23, 2026 3mo ago
CVE-2025-10736	medium	6.5/10	ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulation	Mar 23, 2026 3mo ago
CVE-2026-2421	medium	6.5/10	ilGhera Carta Docente for WooCommerce <= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter	Mar 20, 2026 3mo ago
CVE-2026-25443	high	7.5/10	WordPress Fraud Prevention For Woocommerce plugin <= 2.3.3 - Arbitrary Content Deletion vulnerability	Mar 19, 2026 4mo ago
CVE-2026-27540	critical	9.0/10	WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability	Mar 19, 2026 4mo ago
CVE-2026-27542	critical	9.8/10	WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability	Mar 19, 2026 4mo ago
CVE-2026-1926	medium	5.3/10	Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation	Mar 18, 2026 4mo ago
CVE-2026-32586	medium	5.3/10	WordPress Booster for WooCommerce plugin < 7.11.3 - Broken Access Control vulnerability	Mar 17, 2026 4mo ago
CVE-2026-2579	high	7.5/10	WowStore – Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter	Mar 17, 2026 4mo ago