Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

339,720

All time

Critical · Active

10,855

CVSS ≥ 9.0

New · 14 days

2,599

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-68501	high	7.1/10	WordPress Mollie Payments for WooCommerce plugin <= 8.1.1 - Reflected Cross Site Scripting (XSS) vulnerability	Feb 20, 2026 4mo ago
CVE-2025-68025	medium	6.5/10	WordPress Addonify Floating Cart For WooCommerce plugin <= 1.2.17 - Broken Access Control vulnerability	Feb 20, 2026 4mo ago
CVE-2025-68024	medium	6.5/10	WordPress Addonify – WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability	Feb 20, 2026 4mo ago
CVE-2025-68023	medium	6.5/10	WordPress Addonify – Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerability	Feb 20, 2026 4mo ago
CVE-2025-68022	high	7.3/10	WordPress Plugin BlueX for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability	Feb 20, 2026 4mo ago
CVE-2025-67969	medium	6.5/10	WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerability	Feb 20, 2026 4mo ago
CVE-2026-27327	medium	4.3/10	WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-2232	high	7.5/10	Product Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter	Feb 19, 2026 4mo ago
CVE-2026-27052	high	7.5/10	WordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerability	Feb 19, 2026 4mo ago
CVE-2026-25318	medium	4.3/10	WordPress WiserReview Product Reviews for WooCommerce plugin <= 2.9 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-24375	medium	5.3/10	WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability	Feb 19, 2026 4mo ago
CVE-2026-22333	high	7.2/10	WordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerability	Feb 19, 2026 4mo ago
CVE-2026-1455	medium	4.3/10	Whatsiplus Scheduled Notification for Woocommerce <= 1.0.1 - Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX Action	Feb 19, 2026 4mo ago
CVE-2025-14357	medium	5.3/10	Mega Store Woocommerce <= 5.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change	Feb 19, 2026 4mo ago
CVE-2025-12975	high	7.2/10	CTX Feed – WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation	Feb 19, 2026 4mo ago
CVE-2025-13930	medium	5.3/10	Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion	Feb 19, 2026 4mo ago
CVE-2025-14294	medium	5.3/10	Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification	Feb 19, 2026 4mo ago
CVE-2025-12500	medium	5.3/10	Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.1 - Unauthenticated Limited File Upload	Feb 19, 2026 4mo ago
CVE-2025-12375	medium	6.4/10	Printful Integration for WooCommerce <= 2.2.11 - Authenticated (Contributor+) Server-Side Request Forgery	Feb 19, 2026 4mo ago
CVE-2026-2386	medium	4.3/10	The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'	Feb 18, 2026 4mo ago
CVE-2026-2296	high	7.2/10	Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter	Feb 18, 2026 4mo ago
CVE-2026-2019	high	7.2/10	Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting	Feb 18, 2026 4mo ago
CVE-2026-1906	medium	4.3/10	PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification	Feb 18, 2026 5mo ago
CVE-2026-1925	medium	4.3/10	EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification	Feb 18, 2026 5mo ago
CVE-2025-12075	medium	4.3/10	Order Splitter for WooCommerce <= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure	Feb 18, 2026 5mo ago
CVE-2026-2592	high	7.7/10	Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update	Feb 17, 2026 5mo ago
CVE-2026-1988	high	7.5/10	Flexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute	Feb 14, 2026 5mo ago
CVE-2026-0692	high	7.5/10	BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation	Feb 14, 2026 5mo ago
CVE-2026-1316	high	7.2/10	Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter	Feb 12, 2026 5mo ago
CVE-2025-13391	medium	5.8/10	Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion	Feb 11, 2026 5mo ago