Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,508

All time

Critical · Active

12,465

CVSS ≥ 9.0

New · 14 days

1,080

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1981–1999 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2021-42363	medium	6.1/10	Preview E-Mails for WooCommerce <= 1.6.8 Reflected Cross-Site Scripting	Nov 19, 2021 4y ago
CVE-2021-24835	—	—	WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection	Nov 8, 2021 4y ago
CVE-2021-39347	medium	4.3/10	Stripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account Hijacking	Oct 4, 2021 4y ago
CVE-2021-24679	—	—	Bitcoin / AltCoin Payment Gateway for WooCommerce < 1.6.1 - Reflected Cross-Site Scripting	Oct 4, 2021 4y ago
CVE-2021-34636	high	8.8/10	Countdown and CountUp, WooCommerce Sales Timer <= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site Scripting	Sep 28, 2021 4y ago
CVE-2021-24511	—	—	Create WooCommerce Product Feeds For 40+ Merchants < 3.3.1.0 - Authenticated SQL Injection	Sep 20, 2021 5y ago
CVE-2021-38341	medium	6.1/10	WooCommerce Payment Gateway Per Category <= 2.0.10 Reflected Cross-Site Scripting	Sep 10, 2021 5y ago
CVE-2021-38349	medium	6.1/10	Integration of Moneybird for WooCommerce <= 2.1.1 Reflected Cross-Site Scripting	Sep 10, 2021 5y ago
CVE-2021-24588	—	—	SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting	Sep 6, 2021 5y ago
CVE-2021-34646	critical	9.8/10	Booster for WooCommerce <= 5.4.3 Authentication Bypass	Aug 30, 2021 5y ago
CVE-2021-34664	medium	6.1/10	Moova for WooCommerce <= 3.5 Reflected Cross-Site Scripting	Aug 16, 2021 5y ago
CVE-2021-34619	high	8.8/10	Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin	Jul 21, 2021 5y ago
CVE-2021-24300	—	—	PickPlugins Product Slider for WooCommerce < 1.13.22 - Reflected Cross-Site Scripting (XSS)	May 24, 2021 5y ago
CVE-2021-24323	—	—	Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)	May 17, 2021 5y ago
CVE-2021-24190	—	—	WooCommerce Conditional Marketing Mailer < 1.5.2 - Arbitrary Plugin Installation/Activation via Low Privilege User	May 14, 2021 5y ago
CVE-2021-24262	—	—	WooLentor - WooCommerce Elementor Addons + Builder < 1.8.6 - Contributor+ Stored XSS	May 5, 2021 5y ago
CVE-2021-24212	—	—	WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE	Apr 5, 2021 5y ago
CVE-2021-24171	—	—	WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload	Apr 5, 2021 5y ago
CVE-2021-24169	—	—	Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)	Apr 5, 2021 5y ago