Woocommerce vulnerabilities

Products

• Woocommerce 18
• Automatewoo 8
• Customers Manager 5
• Stripe Payment Gateway 5
• Shipping Multiple Addresses 4
• Bookings 4
• Pre-orders 4
• Product Vendors 3
• Returns And Warranty Requests 3
• Shipping Multiple Addresses 3
• Stripe Payment Gateway 3
• Box Office 3
• Paypal Payments 3
• Box Office 2
• Paypal Checkout Payment Gateway 2
• Payu India Payment Gateway 2
• Persian-woocommerce 2
• Product Add-ons 2
• Product Addons 2
• Brands 2
• Follow-up Emails (automatewoo) 2
• Pre-orders 2
• Square 2

Newest

• unknown woocommerce bookings, woocommerce bookings +1 more WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service CVE-2026-14854 7.5 HighOctober 11, 2026
• unknown woocommerce bookings, woocommerce bookings +1 more WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization CVE-2026-14853 4.3 MediumAugust 23, 2026
• woocommerce paypal payments WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure CVE-2025-14073 5.3 MediumAugust 1, 2026
• automattic woocommerce WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php CVE-2022-50972 9.3 CriticalJune 20, 2026
• woocommerce stripe payment gateway WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter CVE-2026-2381 6.5 MediumJune 16, 2026
• woocommerce paypal payments WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure CVE-2026-9284 8.2 HighMay 23, 2026
• woocommerce woopayments: integrated woocommerce payments WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax CVE-2026-1710 6.5 MediumMarch 31, 2026
• woocommerce square WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id CVE-2025-13457 7.5 HighJanuary 10, 2026
• automattic woocommerce WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting CVE-2025-5062 6.1 MediumMay 22, 2025
• importify (dropshipping woocommerce), woocommerce dropshipping +1 more WordPress Importify (Dropshipping WooCommerce) plugin <= 1.0.4 - Sensitive Data Exposure vulnerability CVE-2023-49194 5.3 MediumDecember 9, 2024
• heolixfy flexible woocommerce checkout field editor, woocommerce checkout field editor +1 more WordPress Flexible Woocommerce Checkout Field Editor plugin <= 2.0.1 - Broken Access Control vulnerability CVE-2023-49817 8.2 HighDecember 9, 2024
• templateinvaders ti woocommerce wishlist, woocommerce +1 more TI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access CVE-2024-10567 7.5 HighDecember 4, 2024
• automattic google for woocommerce, woocommerce +1 more Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File CVE-2024-10486 5.3 MediumNovember 18, 2024
• unknown woocommerce upload files, woocommerce upload files +1 more WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload CVE-2024-10820 9.8 CriticalNovember 13, 2024
• ووکامرس فارسی persian woocommerce, woocommerce persian-woocommerce +1 more WordPress Persian WooCommerce plugin <= 7.1.6 - Broken Access Control vulnerability CVE-2024-43219 5.3 MediumNovember 1, 2024
• majas-lapu-izstrade cartbounty, streamline cartbounty – save and recover abandoned carts for woocommerce, woocommerce streamline.lv +2 more WordPress CartBounty plugin <= 8.2 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-47634 5.4 MediumOctober 20, 2024
• woocommerce smart coupons WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation CVE-2020-36841 5.3 MediumOctober 16, 2024
• woo product vendors Product Vendors <= 2.0.35 - Reflected Cross Site Scripting CVE-2017-20193 4.7 MediumOctober 16, 2024
• automattic woocommerce WooCommerce <= 9.0.2 - Unauthenticated HTML Injection CVE-2024-9944 5.3 MediumOctober 15, 2024
• unknown woocommerce customers manager, woocommerce customers manager +1 more WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF CVE-2024-3983 8.1 HighAugust 1, 2024
• unknown woocommerce customers manager, woocommerce customers manager +1 more WooCommerce Customers Manager < 30.1 - User Deletion via CSRF CVE-2024-2843 6.5 MediumAugust 1, 2024
• unknown woocommerce customers manager, woocommerce customers manager +1 more WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS CVE-2024-1747 6.5 MediumAugust 1, 2024
• woo automatewoo WordPress AutomateWoo plugin <= 5.7.5 - Broken Access Control vulnerability CVE-2023-36512 6.5 MediumJune 19, 2024
• woocommerce stripe payment gateway WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability CVE-2023-35049 7.5 HighJune 19, 2024
• woo woocommerce warranty requests, woocommerce returns and warranty requests +1 more WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability CVE-2023-51495 6.5 MediumJune 14, 2024
• woo woocommerce warranty requests, woocommerce returns and warranty requests +1 more WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability CVE-2023-51496 5.3 MediumJune 14, 2024
• woo woocommerce ship to multiple addresses, woocommerce shipping multiple addresses +1 more WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.9 - Broken Access Control vulnerability CVE-2023-51497 5.4 MediumJune 14, 2024
• automattic woocommerce WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms CVE-2024-37297 Fix available 5.4 MediumJune 12, 2024
• woo woocommerce box office, woocommerce box office +1 more WordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerability CVE-2023-34003 6.5 MediumJune 9, 2024
• woo woocommerce product vendors, woocommerce product vendors +1 more WordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerability CVE-2023-51494 5.3 MediumJune 9, 2024
• woocommerce one page checkout WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability CVE-2023-35881 7.6 HighMay 17, 2024
• unknown woocommerce customers manager, woocommerce customers manager +1 more WooCommerce Customers Manager < 29.8 - Reflected XSS CVE-2024-1743 5.9 MediumApril 24, 2024
• unknown woocommerce customers manager, woocommerce customers manager +1 more WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection CVE-2024-0399 Public exploit 8.1 HighApril 15, 2024
• woocommerce shipping per product WordPress WooCommerce Shipping Per Product plugin <= 2.5.4 - Broken Access Control vulnerability CVE-2023-51499 4.3 MediumApril 12, 2024
• woocommerce stripe payment gateway WordPress WooCommerce Stripe Gateway plugin <= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2023-44999 5.4 MediumMarch 27, 2024
• woocommerce box office WordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerability CVE-2024-24799 6.5 MediumMarch 26, 2024
• payu india, woocommerce payu india payment gateway +1 more WordPress PayU India plugin <= 3.8.8 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-27193 7.1 HighMarch 15, 2024
• automattic woocommerce WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion CVE-2022-0775 4.3 MediumJanuary 16, 2024
• automattic woocommerce WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-52222 4.3 MediumJanuary 8, 2024
• automattic woocommerce stripe, woocommerce stripe payment gateway +1 more WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) CVE-2023-51502 7.5 HighJanuary 5, 2024
• woocommerce product add-ons, product addons +1 more WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection CVE-2023-32795 8.2 HighDecember 28, 2023
• woocommerce shipping multiple addresses WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR) CVE-2023-32799 6.5 MediumDecember 21, 2023
• automattic woocommerce bookings, woocommerce bookings +1 more WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR) CVE-2023-32747 5.4 MediumDecember 21, 2023
• woocommerce automatewoo WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File Upload CVE-2023-33318 9.9 CriticalDecember 20, 2023
• woocommerce automatewoo WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL Injection CVE-2023-32743 7.6 HighDecember 20, 2023
• woocommerce automatewoo WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL Injection CVE-2023-33330 8.5 HighDecember 20, 2023
• automattic woocommerce subscriptions, woocommerce woo subscriptions +1 more WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR) CVE-2023-35914 7.5 HighDecember 20, 2023
• automattic woocommerce square, woocommerce square +1 more WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR) CVE-2023-35876 8.1 HighDecember 20, 2023
• automattic woocommerce gocardless, woocommerce gocardless +1 more WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR) CVE-2023-37871 8.2 HighDecember 20, 2023
• woo product vendors WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL Injection CVE-2023-33331 8.5 HighDecember 18, 2023
• Show olderLoading…