Skip to contentAutomattic Woocommerce vulnerabilities
- automattic woocommerceWordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerabilityCVE-2026-1066087.2 High
- automattic woocommerceWordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerabilityCVE-2026-488887.5 High
- automattic woocommerceWordPress WooCommerce plugin < 11.0 - SQL Injection vulnerabilityCVE-2026-577777.6 High
- automattic woocommerceWooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.phpCVE-2022-509729.3 Critical
- automattic woocommerceWooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRFCVE-2026-35897.5 High
- automattic woocommerceWooCommerce - Subscriber/Customer+ Order Data DisclosureCVE-2025-150336.5 Medium
- automattic woocommerceWooCommerce <= 7.8.2 - Sensitive Information ExposureCVE-2023-73205.3 Medium
- automattic woocommerceWordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-490425.9 Medium
- automattic woocommerceWooCommerce <= 9.4.2 - PostMessage-Based Cross-Site ScriptingCVE-2025-50626.1 Medium
- automattic woocommerceWordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-267625.9 Medium
- automattic google for woocommerce, woocommerce +1 moreGoogle for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info FileCVE-2024-104865.3 Medium
- automattic woocommerceWooCommerce <= 9.0.2 - Unauthenticated HTML InjectionCVE-2024-99445.3 Medium
- automattic woocommerceWordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-396665.9 Medium
- automattic woocommerceWordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerabilityCVE-2024-357773.5 Low
- automattic woocommerceWooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration formsCVE-2024-37297Fix available5.4 Medium
- automattic woocommerceWooCommerce < 8.6 - Contributor+ Private/Draft Products AccessCVE-2024-13104.9 Medium
- automattic woocommerceWordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-221554.3 Medium
- automattic woocommerceWooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment DeletionCVE-2022-07754.3 Medium
- automattic woocommerceWordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-522224.3 Medium
- automattic woocommerce stripe, woocommerce stripe payment gateway +1 moreWordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-515027.5 High
- automattic woocommerce bookings, woocommerce bookings +1 moreWordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-327475.4 Medium
- automattic woocommerce subscriptions, woocommerce woo subscriptions +1 moreWordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-359147.5 High
- automattic woocommerce square, woocommerce square +1 moreWordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-358768.1 High
- automattic woocommerce gocardless, woocommerce gocardless +1 moreWordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-378718.2 High
- automattic woocommerce bookings, woocommerce bookings +1 moreWordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-477874.3 Medium
- automattic woocommerce, woocommerce blocks +1 moreWordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerabilityCVE-2023-477776.5 Medium
- automattic woocommerce payments, woopayments +1 moreAn issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an...CVE-2023-28121Public exploitEPSS 87.4%9.8 Critical
- automattic woocommerceWooCommerce < 6.6.0 - Admin+ Stored HTML InjectionCVE-2022-2099Fix available4.8 Medium
- automattic woocommerceBlind SQL Injection possible via Authenticated Web-hook Search API EndpointCVE-2021-327904.9 Medium
- automattic woocommerce blocks, woocommerce woocommerce-gutenberg-products-block +1 moreArbitrary SQL (SQL injection) possible via the Store API component.CVE-2021-32789Public exploitEPSS 17.2%7.5 High
- automattic woocommerceWoocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)CVE-2021-24323Fix available4.8 Medium
- automattic woocommerce** DISPUTED ** The WooCommerce plugin through 3.x for WordPress has a Directory Traversal...CVE-2017-17058Public exploitDisputedEPSS 23.7%7.5 High