Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

344,172

All time

Critical · Active

11,533

CVSS ≥ 9.0

New · 14 days

2,689

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 181–210 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-2582	medium	6.5/10	Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution	Apr 14, 2026 3mo ago
CVE-2026-4479	medium	4.4/10	WholeSale Products Dynamic Pricing Management WooCommerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings	Apr 14, 2026 3mo ago
CVE-2026-3830	—	—	Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLi	Apr 13, 2026 3mo ago
CVE-2026-4432	—	—	YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR	Apr 10, 2026 3mo ago
CVE-2026-4664	medium	5.3/10	Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter	Apr 10, 2026 3mo ago
CVE-2026-3574	medium	4.4/10	Experto Dashboard for WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' Setting	Apr 9, 2026 4mo ago
CVE-2026-3396	high	7.5/10	WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection	Apr 8, 2026 4mo ago
CVE-2026-1672	medium	6.5/10	BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification	Apr 8, 2026 4mo ago
CVE-2026-1673	medium	4.3/10	BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion	Apr 8, 2026 4mo ago
CVE-2026-39671	high	7.1/10	WordPress Extra Fees Plugin for WooCommerce plugin <= 4.3.3 - Cross Site Request Forgery (CSRF) vulnerability	Apr 8, 2026 4mo ago
CVE-2026-39668	medium	5.3/10	WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability	Apr 8, 2026 4mo ago
CVE-2026-39662	medium	5.3/10	WordPress Product Price by Formula for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability	Apr 8, 2026 4mo ago
CVE-2026-39656	medium	5.3/10	WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability	Apr 8, 2026 4mo ago
CVE-2026-39645	medium	5.4/10	WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability	Apr 8, 2026 4mo ago
CVE-2026-39643	medium	5.3/10	WordPress Payment Plugins for PayPal WooCommerce plugin <= 2.0.13 - Broken Access Control vulnerability	Apr 8, 2026 4mo ago
CVE-2026-39542	medium	5.3/10	WordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerability	Apr 8, 2026 4mo ago
CVE-2026-39508	medium	6.5/10	WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1.1 - Cross Site Scripting (XSS) vulnerability	Apr 8, 2026 4mo ago
CVE-2026-2838	medium	4.4/10	Whole Enquiry Cart for WooCommerce <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole_success_msg' Parameter	Apr 8, 2026 4mo ago
CVE-2026-3311	medium	6.4/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar	Apr 8, 2026 4mo ago
CVE-2026-3499	high	8.8/10	Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions	Apr 8, 2026 4mo ago
CVE-2026-4896	high	8.1/10	WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation	Apr 4, 2026 4mo ago
CVE-2025-15484	—	—	Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass	Apr 1, 2026 4mo ago
CVE-2026-32528	high	7.1/10	WordPress Riode \| Multi-Purpose WooCommerce theme < 1.6.29 - Reflected Cross Site Scripting (XSS) vulnerability	Mar 25, 2026 4mo ago
CVE-2026-32526	high	7.1/10	WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability	Mar 25, 2026 4mo ago
CVE-2026-32522	high	8.6/10	WordPress WooCommerce Support Ticket System plugin < 18.5 - Arbitrary File Deletion vulnerability	Mar 25, 2026 4mo ago
CVE-2026-31921	high	8.2/10	WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability	Mar 25, 2026 4mo ago
CVE-2026-31920	critical	9.3/10	WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - SQL Injection vulnerability	Mar 25, 2026 4mo ago
CVE-2026-27045	high	8.8/10	WordPress WooCommerce Infinite Scroll plugin <= 1.6.2 - PHP Object Injection vulnerability	Mar 25, 2026 4mo ago
CVE-2026-25469	medium	6.5/10	WordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerability	Mar 25, 2026 4mo ago
CVE-2026-25455	medium	6.5/10	WordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerability	Mar 25, 2026 4mo ago