Feed live

WooCommerce vulnerabilities - every known CVE affecting stores and checkout

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

As the extension layer behind the majority of WordPress-powered stores, WooCommerce vulnerabilities carry extra weight when they touch checkout, payment, or customer data flows.

Total CVEs tracked

344,178

All time

Critical · Active

11,533

CVSS ≥ 9.0

New · 14 days

2,693

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-25397	high	7.5/10	WordPress File Uploader for WooCommerce plugin <= 1.0.4 - Path Traversal vulnerability	Mar 25, 2026 4mo ago
CVE-2026-25396	high	7.5/10	WordPress Commerce Coinbase For WooCommerce plugin <= 1.6.6 - Broken Access Control vulnerability	Mar 25, 2026 4mo ago
CVE-2026-25328	medium	6.8/10	WordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerability	Mar 25, 2026 4mo ago
CVE-2026-25317	high	7.5/10	WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.9.0 - Broken Access Control vulnerability	Mar 25, 2026 4mo ago
CVE-2026-24993	critical	9.3/10	WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.3 - SQL Injection vulnerability	Mar 25, 2026 4mo ago
CVE-2026-24372	high	7.5/10	WordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability	Mar 25, 2026 4mo ago
CVE-2026-23977	high	7.5/10	WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability	Mar 25, 2026 4mo ago
CVE-2026-22480	high	7.2/10	WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability	Mar 25, 2026 4mo ago
CVE-2026-3138	medium	6.5/10	Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE	Mar 24, 2026 4mo ago
CVE-2026-4001	critical	9.8/10	Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula	Mar 23, 2026 4mo ago
CVE-2025-10734	medium	5.3/10	ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure	Mar 23, 2026 4mo ago
CVE-2025-10731	medium	5.3/10	ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data Export	Mar 23, 2026 4mo ago
CVE-2025-10679	high	7.3/10	ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution	Mar 23, 2026 4mo ago
CVE-2025-10736	medium	6.5/10	ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulation	Mar 23, 2026 4mo ago
CVE-2026-2421	medium	6.5/10	ilGhera Carta Docente for WooCommerce <= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter	Mar 20, 2026 4mo ago
CVE-2026-25443	high	7.5/10	WordPress Fraud Prevention For Woocommerce plugin <= 2.3.3 - Arbitrary Content Deletion vulnerability	Mar 19, 2026 4mo ago
CVE-2026-27540	critical	9.0/10	WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability	Mar 19, 2026 4mo ago
CVE-2026-27542	critical	9.8/10	WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability	Mar 19, 2026 4mo ago
CVE-2026-1926	medium	5.3/10	Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation	Mar 18, 2026 4mo ago
CVE-2026-32586	medium	5.3/10	WordPress Booster for WooCommerce plugin < 7.11.3 - Broken Access Control vulnerability	Mar 17, 2026 4mo ago
CVE-2026-2579	high	7.5/10	WowStore – Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter	Mar 17, 2026 4mo ago
CVE-2026-32457	medium	5.3/10	WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.18 - Broken Access Control vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32450	medium	6.5/10	WordPress Active Products Tables for WooCommerce plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32443	medium	6.5/10	WordPress Product Feed PRO for WooCommerce plugin <= 13.5.2 - Cross Site Request Forgery (CSRF) vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32412	medium	5.4/10	WordPress Gift Up Gift Cards for WordPress and WooCommerce plugin <= 3.1.7 - Server Side Request Forgery (SSRF) vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32410	medium	5.3/10	WordPress WBW Currency Switcher for WooCommerce plugin <= 2.2.5 - Broken Access Control vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32407	medium	4.3/10	WordPress WPC Smart Wishlist for WooCommerce plugin <= 5.0.8 - Broken Access Control vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32406	medium	4.3/10	WordPress WPC Product Bundles for WooCommerce plugin <= 8.4.5 - Broken Access Control vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32398	medium	6.5/10	WordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerability	Mar 13, 2026 4mo ago
CVE-2026-32372	medium	5.3/10	WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.2.4 - Sensitive Data Exposure vulnerability	Mar 13, 2026 4mo ago