Skip to contentUnknown Woocommerce vulnerabilities
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST EndpointCVE-2026-165745.4 Medium
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture TokenCVE-2026-152115.9 Medium
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin InstallationCVE-2026-152158.8 High
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDORCVE-2026-152144.3 Medium
- unknown wpc name your price for woocommerceWPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select ModeCVE-2026-166207.5 High
- unknown event booking manager for woocommerce (pro)Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket PriceCVE-2026-160675.3 Medium
- payment plugins for paypal woocommerce, unknown payment plugins for paypal woocommerce +1 morePayment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal OrderCVE-2026-133997.5 High
- jconti payment gateway for redsys & woocommerce litePayment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay CallbackCVE-2026-125847.5 High
- unknown integrate phonepe with woocommerceIntegrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID ReuseCVE-2026-105997.5 High
- unknown checkimate — woocommerce checkout, abandoned cart recovery & order bumpsCheckimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded SecretCVE-2026-148298.2 High
- glenwpcoder drag and drop multiple file upload for woocommerceDrag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce OracleCVE-2026-160549.1 Critical
- pepro dev. group peprodev woocommerce receipt uploaderPeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDORCVE-2026-143145.3 Medium
- pepro dev. group peprodev woocommerce receipt uploaderPeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDORCVE-2026-143135.3 Medium
- unknown dhl shipping germany for woocommerceDHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads DirectoryCVE-2026-169933.7 Low
- unknown dhl shipping germany for woocommerceDHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDORCVE-2026-169815.3 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST APICVE-2026-165654.3 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST EndpointCVE-2026-165644.3 Medium
- thedotstore product attachment for woocommerceWooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media DownloadCVE-2026-162857.5 High
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_eventCVE-2026-160645.4 Medium
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline ContentCVE-2026-160635.4 Medium
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ ContentCVE-2026-160626.6 Medium
- unknown ai chatbot for woocommerceChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_responseCVE-2026-152417.5 High
- unknown pixel tag manager for woocommercePixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event SubmissionCVE-2026-143156.5 Medium
- acowebs dynamic pricing with discount rules for woocommerceDynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjaxCVE-2026-137257.1 High
- unknown buckaroo woocommerce payments pluginWC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order RefundCVE-2026-133296.5 Medium
- unknown direct payments for woocommerceDirect Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX ActionsCVE-2026-129665.3 Medium
- unknown product feed manager for woocommerceProduct Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed FilterCVE-2026-152588.1 High
- unknown points and rewards for woocommercePoints and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDORCVE-2026-117825.9 Medium
- unknown facturaone para woocommerce con verifactuWP FacturaONE < 5.37 - Unauthenticated Remote Code ExecutionCVE-2026-142899.0 Critical
- silverplugins217 custom fields account registration for woocommerceCustom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege EscalationCVE-2026-13152Public exploit8.1 High
- elbanyaoui clover payment gateway by zaytech for woocommerceClover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_orderCVE-2026-124937.5 High
- printcart web to print product designer for woocommerce, unknown printcart web to print product designer for woocommerce +1 morePrintcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request ForgeryCVE-2025-156628.6 High
- pi web solution product enquiry for woocommerceWordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-595127.1 High
- unknown wps bookings for woocommerceWPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDORCVE-2026-123935.4 Medium
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_mediaCVE-2026-12684Public exploit6.5 Medium
- tyche softwares abandoned cart lite for woocommerceAbandoned Cart Lite for WooCommerce < 6.8.2 - Unauthenticated Account Takeover via Malleable Recovery-Link TokenCVE-2026-125858.1 High
- unknown happy coders otp login for woocommerceHappy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_userCVE-2026-124929.8 Critical
- mklacroix product configurator for woocommerceProduct Configurator for WooCommerce < 1.7.3 - Unauthenticated Private/Draft Product Data Disclosure via pc_get_dataCVE-2026-115687.5 High
- printcart web to print product designer for woocommerce, unknown printcart web to print product designer for woocommerce +1 morePrintcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Unauthenticated Folder Content Disclosure via Path TraversalCVE-2025-102685.3 Medium
- unknown product slider for woocommerce pro, real testimonials pro, smart-post-show-pro +2 moreShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update ServerCVE-2026-107357.5 High
- unknown ultimate-woocommerce-auction-proUltimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctionsCVE-2026-42597.1 High
- unknown ultimate-woocommerce-auction-proUltimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_auctions_bids_listCVE-2026-41106.1 Medium
- unknown wemail: email marketing, email automation, newsletters, subscribers & email optins for woocommerceweMail < 2.1.3 - Reflected Cross-Site ScriptingCVE-2026-80897.1 High
- brainstorm force woocommerce cart abandonment recoveryWordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerabilityCVE-2026-394707.2 High
- eupago gateway for woocommerce, unknown eupago gateway for woocommerce +1 moreEupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund InitiationCVE-2026-78628.6 High
- fortispay fortis for woocommerceFortis For WooCommerce < 1.3.1 - Sensitive API Key DisclosureCVE-2025-156097.5 High
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLiCVE-2026-38308.6 High
- unknown yith woocommerce wishlist, yith woocommerce wishlist +1 moreYITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDORCVE-2026-44326.5 Medium
- unknown order notification for woocommerceOrder Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission BypassCVE-2025-154849.1 Critical
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLECVE-2026-31386.5 Medium
- Show moreLoading…