Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

349,530

All time

Critical · Active

12,232

CVSS ≥ 9.0

New · 14 days

3,089

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1951–1980 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2021-24928	—	—	Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL Injection	Feb 7, 2022 4y ago
CVE-2021-25085	—	—	WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site Scripting	Feb 1, 2022 4y ago
CVE-2021-25062	—	—	Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting	Jan 24, 2022 4y ago
CVE-2021-24974	—	—	Product Feed PRO for WooCommerce < 11.0.7 - Subscriber+ Settings Update to Stored XSS	Jan 24, 2022 4y ago
CVE-2021-25001	—	—	Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in Product XML Feeds Module	Jan 3, 2022 4y ago
CVE-2021-25000	—	—	Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in General Module	Jan 3, 2022 4y ago
CVE-2021-24999	—	—	Booster for Woocommerce < 5.4.9 - Reflected Cross-Site Scripting in PDF Invoicing Module	Jan 3, 2022 4y ago
CVE-2021-24991	—	—	WooCommerce PDF Invoices & Packing Slips < 2.10.5 - Reflected Cross-Site Scripting	Jan 3, 2022 4y ago
CVE-2021-24849	—	—	WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection	Dec 21, 2021 4y ago
CVE-2021-24846	—	—	Ni WooCommerce Custom Order Status < 1.9.7 - Subscriber+ SQL Injection	Dec 21, 2021 4y ago
CVE-2021-39308	medium	6.1/10	WooCommerce myghpay Payment Gateway <= 3.0 Reflected Cross-Site Scripting	Dec 14, 2021 4y ago
CVE-2021-39309	medium	6.1/10	Parsian Bank Gateway for Woocommerce <= 1.0 Reflected Cross-Site Scripting	Dec 14, 2021 4y ago
CVE-2021-39314	medium	6.1/10	WooCommerce EnvioPack <= 1.2 Reflected Cross-Site Scripting	Dec 14, 2021 4y ago
CVE-2021-42367	medium	6.4/10	Variation Swatches for WooCommerce <= 2.1.1 Authenticated Stored Cross-Site Scripting	Dec 14, 2021 4y ago
CVE-2021-24938	—	—	WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site Scripting	Dec 6, 2021 4y ago
CVE-2021-42363	medium	6.1/10	Preview E-Mails for WooCommerce <= 1.6.8 Reflected Cross-Site Scripting	Nov 19, 2021 4y ago
CVE-2021-24835	—	—	WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection	Nov 8, 2021 4y ago
CVE-2021-39347	medium	4.3/10	Stripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account Hijacking	Oct 4, 2021 4y ago
CVE-2021-24679	—	—	Bitcoin / AltCoin Payment Gateway for WooCommerce < 1.6.1 - Reflected Cross-Site Scripting	Oct 4, 2021 4y ago
CVE-2021-34636	high	8.8/10	Countdown and CountUp, WooCommerce Sales Timer <= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site Scripting	Sep 28, 2021 4y ago
CVE-2021-24511	—	—	Create WooCommerce Product Feeds For 40+ Merchants < 3.3.1.0 - Authenticated SQL Injection	Sep 20, 2021 4y ago
CVE-2021-38341	medium	6.1/10	WooCommerce Payment Gateway Per Category <= 2.0.10 Reflected Cross-Site Scripting	Sep 10, 2021 4y ago
CVE-2021-38349	medium	6.1/10	Integration of Moneybird for WooCommerce <= 2.1.1 Reflected Cross-Site Scripting	Sep 10, 2021 4y ago
CVE-2021-24588	—	—	SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting	Sep 6, 2021 4y ago
CVE-2021-34646	critical	9.8/10	Booster for WooCommerce <= 5.4.3 Authentication Bypass	Aug 30, 2021 5y ago
CVE-2021-34664	medium	6.1/10	Moova for WooCommerce <= 3.5 Reflected Cross-Site Scripting	Aug 16, 2021 5y ago
CVE-2021-34619	high	8.8/10	Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin	Jul 21, 2021 5y ago
CVE-2021-24300	—	—	PickPlugins Product Slider for WooCommerce < 1.13.22 - Reflected Cross-Site Scripting (XSS)	May 24, 2021 5y ago
CVE-2021-24323	—	—	Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)	May 17, 2021 5y ago
CVE-2021-24190	—	—	WooCommerce Conditional Marketing Mailer < 1.5.2 - Arbitrary Plugin Installation/Activation via Low Privilege User	May 14, 2021 5y ago