Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

352,157

All time

Critical · Active

12,432

CVSS ≥ 9.0

New · 14 days

2,125

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-45211	high	8.5/10	WordPress APIExperts Square for WooCommerce plugin <= 4.7.1 - SQL Injection vulnerability	May 12, 2026 4mo ago
CVE-2026-7626	medium	5.3/10	Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields	May 12, 2026 4mo ago
CVE-2026-27329	medium	5.3/10	WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability	May 7, 2026 4mo ago
CVE-2026-3208	medium	5.3/10	Mercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure	May 6, 2026 4mo ago
CVE-2026-0703	medium	6.4/10	NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode	May 2, 2026 4mo ago
CVE-2026-3504	medium	5.3/10	Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint	May 2, 2026 4mo ago
CVE-2026-2554	high	8.1/10	WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion	May 2, 2026 4mo ago
CVE-2026-6447	medium	4.4/10	Call for Price for WooCommerce <= 4.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings	May 2, 2026 4mo ago
CVE-2026-6725	medium	6.4/10	WPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute	Apr 28, 2026 4mo ago
CVE-2026-28040	medium	6.5/10	WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability	Apr 23, 2026 5mo ago
CVE-2026-4140	medium	4.3/10	Ni WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action	Apr 22, 2026 5mo ago
CVE-2026-3355	medium	6.1/10	Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch'	Apr 16, 2026 5mo ago
CVE-2026-5050	high	7.5/10	Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation	Apr 16, 2026 5mo ago
CVE-2026-6370	medium	5.9/10	WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability	Apr 15, 2026 5mo ago
CVE-2026-2582	medium	6.5/10	Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution	Apr 14, 2026 5mo ago
CVE-2026-4479	medium	4.4/10	WholeSale Products Dynamic Pricing Management WooCommerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings	Apr 14, 2026 5mo ago
CVE-2026-3830	—	—	Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLi	Apr 13, 2026 5mo ago
CVE-2026-4432	—	—	YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR	Apr 10, 2026 5mo ago
CVE-2026-4664	medium	5.3/10	Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter	Apr 10, 2026 5mo ago
CVE-2026-3574	medium	4.4/10	Experto Dashboard for WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' Setting	Apr 9, 2026 5mo ago
CVE-2026-3396	high	7.5/10	WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection	Apr 8, 2026 5mo ago
CVE-2026-1672	medium	6.5/10	BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification	Apr 8, 2026 5mo ago
CVE-2026-1673	medium	4.3/10	BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion	Apr 8, 2026 5mo ago
CVE-2026-39671	high	7.1/10	WordPress Extra Fees Plugin for WooCommerce plugin <= 4.3.3 - Cross Site Request Forgery (CSRF) vulnerability	Apr 8, 2026 5mo ago
CVE-2026-39668	medium	5.3/10	WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability	Apr 8, 2026 5mo ago
CVE-2026-39662	medium	5.3/10	WordPress Product Price by Formula for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability	Apr 8, 2026 5mo ago
CVE-2026-39656	medium	5.3/10	WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability	Apr 8, 2026 5mo ago
CVE-2026-39645	medium	5.4/10	WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability	Apr 8, 2026 5mo ago
CVE-2026-39643	medium	5.3/10	WordPress Payment Plugins for PayPal WooCommerce plugin <= 2.0.13 - Broken Access Control vulnerability	Apr 8, 2026 5mo ago
CVE-2026-39542	medium	5.3/10	WordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerability	Apr 8, 2026 5mo ago