Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,530

All time

Critical · Active

12,232

CVSS ≥ 9.0

New · 14 days

3,089

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1861–1890 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2023-0144	—	—	Event Manager and Tickets Selling Plugin for WooCommerce < 3.8.0 - Contributor+ Stored XSS	Feb 6, 2023 3y ago
CVE-2022-29416	medium	4.7/10	WordPress Afterpay Gateway for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)	Feb 6, 2023 3y ago
CVE-2022-46815	medium	5.4/10	WordPress Conditional Shipping for WooCommerce Plugin <= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 2, 2023 3y ago
CVE-2022-36401	medium	5.4/10	WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)	Feb 2, 2023 3y ago
CVE-2022-4395	—	—	Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload	Jan 30, 2023 3y ago
CVE-2022-4872	—	—	WooCommerce Chained Products < 2.12.0 - Unauthenticated Arbitrary Options Update to 'no'	Jan 30, 2023 3y ago
CVE-2022-4017	—	—	Booster for WooCommerce - Multiple CSRF	Jan 23, 2023 3y ago
CVE-2022-4629	—	—	Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in Shortcode	Jan 23, 2023 3y ago
CVE-2022-4547	—	—	Conditional Payment Methods for WooCommerce <= 1.0 - Admin+ SQLi	Jan 16, 2023 3y ago
CVE-2022-4426	—	—	Mautic Integration For WooCommerce < 1.0.3 - Arbitrary Options Update via CSRF	Jan 9, 2023 3y ago
CVE-2022-3923	—	—	ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup	Jan 9, 2023 3y ago
CVE-2022-3860	—	—	Visual Email Designer for WooCommerce < 1.7.2 - Multiple Author+ SQLi	Jan 2, 2023 3y ago
CVE-2022-4329	—	—	Product list Widget for Woocommerce <= 1.0 - Reflected XSS	Jan 2, 2023 3y ago
CVE-2022-4109	—	—	Wholesale Market for WooCommerce < 2.0.0 - Admin+ Arbitrary Log Download	Jan 2, 2023 3y ago
CVE-2022-4047	—	—	Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload	Dec 26, 2022 3y ago
CVE-2022-4227	—	—	Booster for WooCommerce - Reflected Cross-Site Scripting	Dec 26, 2022 3y ago
CVE-2022-4106	—	—	Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download	Dec 19, 2022 3y ago
CVE-2022-4107	—	—	SMSA Shipping for WooCommerce < 1.0.5 - Subscriber+ Arbitrary File Download	Dec 19, 2022 3y ago
CVE-2022-4108	—	—	Wholesale Market for WooCommerce < 1.0.8 - Admin+ Arbitrary File Download	Dec 19, 2022 3y ago
CVE-2022-4016	—	—	Booster for WooCommerce - Custom Role Creation/Deletion via CSRF	Dec 12, 2022 3y ago
CVE-2022-4000	—	—	WooCommerce Shipping - DPD baltic < 1.2.11 - Admin+ Stored XSS	Dec 12, 2022 3y ago
CVE-2022-3999	—	—	WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion	Dec 12, 2022 3y ago
CVE-2022-45359	critical	9.8/10	WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload	Dec 6, 2022 3y ago
CVE-2022-3995	medium	4.3/10	TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference	Nov 29, 2022 3y ago
CVE-2022-3603	—	—	Export customers list CSV for WooCommerce < 2.0.69 - CSV Injection	Nov 28, 2022 3y ago
CVE-2022-3490	—	—	Checkout Field Editor for WooCommerce < 1.8.0 - Admin+ PHP Object Injection	Nov 28, 2022 3y ago
CVE-2022-3763	—	—	Booster for WooCommerce - Checkout Files Deletion via CSRF	Nov 21, 2022 3y ago
CVE-2022-3762	—	—	Booster for WooCommerce - ShopManager+ Arbitrary File Download	Nov 21, 2022 3y ago
CVE-2022-41655	medium	4.3/10	WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability	Nov 18, 2022 3y ago
CVE-2022-41685	medium	5.4/10	Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Integration for Szamlazz.hu & WooCommerce and Csomagpontok és szállítási címkék WooCommerce hez plugins	Nov 18, 2022 3y ago