Skip to contentUnknown Woocommerce vulnerabilities
- unknown visma pay for woocommerceVisma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return EndpointCVE-2026-1033086.5 Medium
- unknown cart abandonment recovery for woocommerceCart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDORCVE-2026-969005.3 Medium
- unknown paymentfor gateway for woocommercePaymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card CallbacksCVE-2026-943605.3 Medium
- unknown yith woocommerce popupYITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta DeletionCVE-2026-924264.9 Medium
- robokassa payment gateway for woocommerce, unknown robokassa payment gateway for woocommerce +1 moreRobokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to FailedCVE-2026-910765.3 Medium
- unknown asaas gateway for woocommerceAsaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via WebhookCVE-2026-879745.3 Medium
- unknown product feed for google shopping, microsoft advertising and 40+ channels for woocommerce merchantProduct Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store RegistrationCVE-2026-879685.3 Medium
- trust payments gateway for woocommerce, unknown trust payments gateway for woocommerce +1 moreTrust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return PageCVE-2026-878436.5 Medium
- unknown codeatoz b2b suite for woocommerceCodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote DisclosureCVE-2026-1059695.3 Medium
- unknown walletdoc payment gateway for woocommerceWalletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via WebhookCVE-2026-1033078.6 High
- pluggabl llc. booster elite for woocommerceWordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerabilityCVE-2023-259966.5 Medium
- unknown veeqo for woocommerceVeeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_processCVE-2026-935504.3 Medium
- unknown fundiin cho woocommerceFundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential DisclosureCVE-2026-816499.1 Critical
- unknown woocommerce bookings, woocommerce bookings +1 moreWooCommerce Bookings < 3.11.0 - Unauthenticated Denial of ServiceCVE-2026-148547.5 High
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST EndpointCVE-2026-1076942.7 Low
- unknown sku error fixer for woocommerceSKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation DeletionCVE-2026-868506.5 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer AmountCVE-2026-935096.5 Medium
- unknown track orders for woocommerceTrack Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' ParameterCVE-2026-942755.3 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDORCVE-2026-942466.3 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDORCVE-2026-942456.5 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via ExportCVE-2026-942444.3 Medium
- unknown integration for epos now and woocommerceIntegration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue DisclosureCVE-2026-1033235.9 Medium
- imaginate solutions file uploads addon for woocommerceFile Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File DisclosureCVE-2026-783715.9 Medium
- imaginate solutions file uploads addon for woocommerceFile Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File AccessCVE-2026-136075.9 Medium
- razorpay for woocommerce, unknown razorpay for woocommerce +1 moreRazorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDORCVE-2026-1041185.3 Medium
- unknown mailchimp for woocommerceMailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and DeletionCVE-2026-924375.3 Medium
- unknown webtoffee gift cards for woocommerceWebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amountCVE-2026-910205.3 Medium
- unknown yith woocommerce ajax searchWordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-963527.1 High
- unknown mailchimp for woocommerceMailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDORCVE-2026-924365.3 Medium
- unknown sumit payment gateway for woocommerceSUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPNCVE-2026-840915.3 Medium
- paymob for woocommerce, unknown paymob for woocommerce +1 morePaymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction CallbackCVE-2026-879785.3 Medium
- gplsaver np quote request for woocommerceNP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request PageCVE-2026-93528Public exploit3.7 Low
- unknown points and rewards for woocommercePoints and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_pointsCVE-2026-935104.3 Medium
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_listCVE-2026-910772.7 Low
- unknown wpc smart compare for woocommerceWPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_loadCVE-2026-909855.3 Medium
- unknown product badge, label, countdown timer for woocommerceSale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product DisclosureCVE-2026-889295.3 Medium
- paymob for woocommerce, unknown paymob for woocommerce +1 morePaymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX ActionsCVE-2026-879814.7 Medium
- paymob for woocommerce, unknown paymob for woocommerce +1 morePaymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via WebhookCVE-2026-879795.3 Medium
- payment plugins for paypal woocommerce, unknown payment plugins for paypal woocommerce +1 morePayment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order IDCVE-2026-803426.5 Medium
- unknown social commerce for woocommerceSocial Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status UpdateCVE-2026-867855.3 Medium
- easy payment payment gateway for paypal on woocommercePayment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment ConfusionCVE-2026-924005.3 Medium
- unknown mailchimp for woocommerceMailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST APICVE-2026-924355.3 Medium
- linknacional rede itaú for woocommerce — payment pix, credit card and debitRede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX WebhookCVE-2026-924305.3 Medium
- quadlayers checkout field manager (checkout manager) for woocommerceCheckout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom FieldCVE-2026-878314.3 Medium
- quadlayers checkout field manager (checkout manager) for woocommerceCheckout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID ReparentingCVE-2026-878294.3 Medium
- robokassa payment gateway for woocommerce, unknown robokassa payment gateway for woocommerce +1 moreRobokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT CallbackCVE-2026-910173.7 Low
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential DisclosureCVE-2026-910194.9 Medium
- unknown active woot products tables for woocommerce. 100% freeActive Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachmentCVE-2026-910094.3 Medium
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation PanelCVE-2026-910083.7 Low
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRFCVE-2026-878604.3 Medium
- Show moreLoading…