Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,478

All time

Critical · Active

12,462

CVSS ≥ 9.0

New · 14 days

1,062

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1831–1860 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-33316	medium	5.4/10	WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)	May 28, 2023 3y ago
CVE-2023-33216	medium	5.9/10	WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS)	May 28, 2023 3y ago
CVE-2022-46856	medium	5.4/10	WordPress Woocommerce Product Designer Plugin <= 4.3.3 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-46810	medium	4.3/10	WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-45367	medium	4.3/10	WordPress Custom Order Numbers for WooCommerce Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-41635	medium	4.3/10	WordPress Advanced Shipment Tracking for WooCommerce Plugin <= 3.5.2 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-46812	medium	4.3/10	WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-47164	medium	4.3/10	WordPress Event Manager for WooCommerce Plugin <= 3.7.7 is vulnerable to Cross Site Request Forgery (CSRF)	May 25, 2023 3y ago
CVE-2022-46794	medium	4.3/10	WordPress WooCommerce Weight Based Shipping Plugin <= 5.4.1 is vulnerable to Cross Site Request Forgery (CSRF)	May 24, 2023 3y ago
CVE-2022-45376	medium	4.3/10	WordPress Side Cart Woocommerce (Ajax) Plugin < 2.1 is vulnerable to Cross Site Request Forgery (CSRF)	May 22, 2023 3y ago
CVE-2023-2276	critical	9.8/10	WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change	May 20, 2023 3y ago
CVE-2023-2706	high	8.1/10	OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation	May 17, 2023 3y ago
CVE-2023-1839	—	—	Product Addons & Fields for WooCommerce < 32.0.6 - Admin+ Stored Cross-Site Scripting	May 15, 2023 3y ago
CVE-2023-2179	—	—	WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update	May 15, 2023 3y ago
CVE-2022-46858	high	7.1/10	WordPress Product Specifications for Woocommerce Plugin <= 0.6.0 is vulnerable to Cross Site Scripting (XSS)	May 9, 2023 3y ago
CVE-2022-46864	high	7.1/10	WordPress Woocommerce Custom Checkout Fields Editor With Drag & Drop Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)	May 9, 2023 3y ago
CVE-2022-46822	high	7.1/10	WordPress WooCommerce JazzCash Gateway Plugin Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)	May 9, 2023 3y ago
CVE-2023-22710	high	7.1/10	WordPress Return and Warranty Management System for WooCommerce Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)	May 8, 2023 3y ago
CVE-2023-0537	—	—	Product Slider For WooCommerce Lite <= 1.1.7 - Contributor+ Stored XSS	May 8, 2023 3y ago
CVE-2023-0948	—	—	Japanized For WooCommerce < 2.5.8 - Reflected XSS	May 8, 2023 3y ago
CVE-2022-47449	high	7.1/10	WordPress Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD Plugin <= 3.1.5 is vulnerable to Cross Site Scripting (XSS)	May 4, 2023 3y ago
CVE-2023-29170	medium	5.9/10	WordPress Product Enquiry for WooCommerce Plugin <= 2.2.12 is vulnerable to Cross Site Scripting (XSS)	Apr 7, 2023 3y ago
CVE-2023-29094	medium	5.9/10	WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.20 is vulnerable to Cross Site Scripting (XSS)	Apr 7, 2023 3y ago
CVE-2022-46793	medium	5.4/10	WordPress Product Feed PRO for WooCommerce Plugin <= 12.4.4 is vulnerable to Cross Site Request Forgery (CSRF)	Apr 6, 2023 3y ago
CVE-2023-0503	—	—	Free WooCommerce Theme 99fy Extension < 1.2.8 - Arbitrary Plugin Activation via CSRF	Mar 27, 2023 3y ago
CVE-2022-46843	high	7.1/10	WordPress Woocommerce Vietnam Checkout Plugin <= 2.0.4 is vulnerable to Cross Site Scripting (XSS)	Mar 27, 2023 3y ago
CVE-2022-47173	medium	5.9/10	WordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.62.0 is vulnerable to Cross Site Scripting (XSS)	Mar 23, 2023 3y ago
CVE-2022-47589	medium	5.9/10	WordPress CTT Expresso para WooCommerce Plugin <= 3.2.11 is vulnerable to Cross Site Scripting (XSS)	Mar 23, 2023 3y ago
CVE-2023-28422	medium	5.9/10	WordPress Event Manager for WooCommerce Plugin <= 3.8.6 is vulnerable to Cross Site Scripting (XSS)	Mar 23, 2023 3y ago
CVE-2023-0865	—	—	WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR	Mar 20, 2023 3y ago