Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,530

All time

Critical · Active

12,232

CVSS ≥ 9.0

New · 14 days

3,091

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1801–1830 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-34170	medium	5.9/10	WordPress Quick/Bulk Order Form for WooCommerce Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)	Jun 22, 2023 3y ago
CVE-2023-35917	medium	4.3/10	WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)	Jun 22, 2023 3y ago
CVE-2023-35918	high	7.1/10	WordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)	Jun 22, 2023 3y ago
CVE-2019-25152	high	7.2/10	Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting	Jun 22, 2023 3y ago
CVE-2023-34000	high	7.5/10	WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)	Jun 14, 2023 3y ago
CVE-2023-2275	medium	4.3/10	WooCommerce Multivendor Marketplace – REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API	Jun 9, 2023 3y ago
CVE-2023-2986	critical	9.8/10	Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass	Jun 8, 2023 3y ago
CVE-2020-36731	high	7.2/10	Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update	Jun 7, 2023 3y ago
CVE-2020-36725	high	8.8/10	TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update	Jun 7, 2023 3y ago
CVE-2020-36696	high	7.5/10	Product Input Fields for WooCommerce <= 1.2.6 - Missing Authorization	Jun 7, 2023 3y ago
CVE-2023-2781	high	8.1/10	User Email Verification for WooCommerce <= 3.5.0 - Authentication Bypass	Jun 2, 2023 3y ago
CVE-2023-2256	—	—	Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting	May 30, 2023 3y ago
CVE-2022-45372	medium	4.3/10	WordPress Product Gallery Slider for WooCommerce Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF)	May 29, 2023 3y ago
CVE-2023-33332	high	7.1/10	WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS)	May 28, 2023 3y ago
CVE-2023-33319	high	7.1/10	WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS)	May 28, 2023 3y ago
CVE-2023-33316	medium	5.4/10	WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)	May 28, 2023 3y ago
CVE-2023-33216	medium	5.9/10	WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS)	May 28, 2023 3y ago
CVE-2022-46856	medium	5.4/10	WordPress Woocommerce Product Designer Plugin <= 4.3.3 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-46810	medium	4.3/10	WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-45367	medium	4.3/10	WordPress Custom Order Numbers for WooCommerce Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-41635	medium	4.3/10	WordPress Advanced Shipment Tracking for WooCommerce Plugin <= 3.5.2 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-46812	medium	4.3/10	WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-47164	medium	4.3/10	WordPress Event Manager for WooCommerce Plugin <= 3.7.7 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-46794	medium	4.3/10	WordPress WooCommerce Weight Based Shipping Plugin <= 5.4.1 is vulnerable to Cross Site Request Forgery (CSRF)	May 24, 2023 3y ago
CVE-2022-45376	medium	4.3/10	WordPress Side Cart Woocommerce (Ajax) Plugin < 2.1 is vulnerable to Cross Site Request Forgery (CSRF)	May 22, 2023 3y ago
CVE-2023-2276	critical	9.8/10	WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change	May 20, 2023 3y ago
CVE-2023-2706	high	8.1/10	OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation	May 17, 2023 3y ago
CVE-2023-1839	—	—	Product Addons & Fields for WooCommerce < 32.0.6 - Admin+ Stored Cross-Site Scripting	May 15, 2023 3y ago
CVE-2023-2179	—	—	WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update	May 15, 2023 3y ago
CVE-2022-46858	high	7.1/10	WordPress Product Specifications for Woocommerce Plugin <= 0.6.0 is vulnerable to Cross Site Scripting (XSS)	May 9, 2023 3y ago