Woocommerce Woocommerce vulnerabilities

• unknown woocommerce stripe payment gateway, woocommerce stripe payment gateway +1 more WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express Checkout CVE-2026-123145 4.4 MediumNovember 9, 2026
• unknown woocommerce bookings, woocommerce bookings +1 more WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service CVE-2026-14854 7.5 HighOctober 11, 2026
• unknown woocommerce bookings, woocommerce bookings +1 more WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization CVE-2026-14853 4.3 MediumAugust 23, 2026
• woocommerce paypal payments WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure CVE-2025-14073 5.3 MediumAugust 1, 2026
• automattic woocommerce WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php CVE-2022-50972 9.3 CriticalJune 20, 2026
• woocommerce stripe payment gateway WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter CVE-2026-2381 6.5 MediumJune 16, 2026
• woocommerce paypal payments WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure CVE-2026-9284 8.2 HighMay 23, 2026
• woocommerce woopayments: integrated woocommerce payments WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax CVE-2026-1710 6.5 MediumMarch 31, 2026
• woocommerce square WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id CVE-2025-13457 7.5 HighJanuary 10, 2026
• automattic woocommerce WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting CVE-2025-5062 6.1 MediumMay 22, 2025
• templateinvaders ti woocommerce wishlist, woocommerce +1 more TI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access CVE-2024-10567 7.5 HighDecember 4, 2024
• automattic google for woocommerce, woocommerce +1 more Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File CVE-2024-10486 5.3 MediumNovember 18, 2024
• ووکامرس فارسی persian woocommerce, woocommerce persian-woocommerce +1 more WordPress Persian WooCommerce plugin <= 7.1.6 - Broken Access Control vulnerability CVE-2024-43219 5.3 MediumNovember 1, 2024
• woocommerce smart coupons WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation CVE-2020-36841 5.3 MediumOctober 16, 2024
• automattic woocommerce WooCommerce <= 9.0.2 - Unauthenticated HTML Injection CVE-2024-9944 5.3 MediumOctober 15, 2024
• unknown woocommerce customers manager, woocommerce customers manager +1 more WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF CVE-2024-3983 8.1 HighAugust 1, 2024
• unknown woocommerce customers manager, woocommerce customers manager +1 more WooCommerce Customers Manager < 30.1 - User Deletion via CSRF CVE-2024-2843 6.5 MediumAugust 1, 2024
• unknown woocommerce customers manager, woocommerce customers manager +1 more WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS CVE-2024-1747 6.5 MediumAugust 1, 2024
• woocommerce stripe payment gateway WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability CVE-2023-35049 7.5 HighJune 19, 2024
• automattic woocommerce WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms CVE-2024-37297 Fix available 5.4 MediumJune 12, 2024
• woo woocommerce box office, woocommerce box office +1 more WordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerability CVE-2023-34003 6.5 MediumJune 9, 2024
• woocommerce one page checkout WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability CVE-2023-35881 7.6 HighMay 17, 2024
• unknown woocommerce customers manager, woocommerce customers manager +1 more WooCommerce Customers Manager < 29.8 - Reflected XSS CVE-2024-1743 5.9 MediumApril 24, 2024
• unknown woocommerce customers manager, woocommerce customers manager +1 more WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection CVE-2024-0399 Public exploit 8.1 HighApril 15, 2024
• woocommerce shipping per product WordPress WooCommerce Shipping Per Product plugin <= 2.5.4 - Broken Access Control vulnerability CVE-2023-51499 4.3 MediumApril 12, 2024
• woocommerce stripe payment gateway WordPress WooCommerce Stripe Gateway plugin <= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2023-44999 5.4 MediumMarch 27, 2024
• woocommerce box office WordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerability CVE-2024-24799 6.5 MediumMarch 26, 2024
• automattic woocommerce WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion CVE-2022-0775 4.3 MediumJanuary 16, 2024
• automattic woocommerce WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-52222 4.3 MediumJanuary 8, 2024
• automattic woocommerce stripe, woocommerce stripe payment gateway +1 more WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) CVE-2023-51502 7.5 HighJanuary 5, 2024
• automattic woocommerce bookings, woocommerce bookings +1 more WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR) CVE-2023-32747 5.4 MediumDecember 21, 2023
• automattic woocommerce square, woocommerce square +1 more WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR) CVE-2023-35876 8.1 HighDecember 20, 2023
• automattic woocommerce bookings, woocommerce bookings +1 more WordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-47787 4.3 MediumDecember 18, 2023
• woocommerce box office WordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS) CVE-2023-34004 6.5 MediumAugust 30, 2023
• woocommerce brands WordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS) CVE-2023-32746 6.5 MediumAugust 30, 2023
• unknown woocommerce pre-orders, woocommerce pre-orders +1 more WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS) CVE-2023-32793 6.5 MediumAugust 30, 2023
• unknown woocommerce pre-orders, woocommerce pre-orders +1 more WordPress WooCommerce Pre-Orders Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS) CVE-2023-32802 7.1 HighAugust 30, 2023
• pi websolution product page shipping calculator for woocommerce, woocommerce +1 more WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.25 is vulnerable to Cross Site Scripting (XSS) CVE-2023-32575 5.9 MediumAugust 25, 2023
• unknown woocommerce pre-orders, woocommerce pre-orders +1 more WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF CVE-2023-3508 6.5 MediumJuly 31, 2023
• unknown woocommerce pre-orders, woocommerce pre-orders +1 more WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF CVE-2023-3507 6.5 MediumJuly 31, 2023
• woocommerce order barcodes WordPress WooCommerce Order Barcodes Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-36511 4.3 MediumJuly 17, 2023
• woocommerce brands WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-35880 5.4 MediumJuly 17, 2023
• woocommerce paypal payments WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-35917 4.3 MediumJune 22, 2023
• woocommerce stripe payment gateway WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR) CVE-2023-34000 7.5 HighJune 14, 2023
• woo woocommerce product vendors, woocommerce product vendors +1 more WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS) CVE-2023-33332 7.1 HighMay 28, 2023
• woocommerce automatewoo, follow-up emails (automatewoo) +1 more WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS) CVE-2023-33319 7.1 HighMay 28, 2023
• woocommerce automatewoo, follow-up emails (automatewoo) +1 more WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-33316 5.4 MediumMay 28, 2023
• unknown woocommerce order status change notifier, woocommerce order status change notifier +1 more WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update CVE-2023-2179 6.5 MediumMay 15, 2023
• automattic woocommerce WooCommerce < 6.6.0 - Admin+ Stored HTML Injection CVE-2022-2099 Fix available 4.8 MediumJuly 17, 2022
• unknown ووکامرس فارسی, woocommerce persian-woocommerce +1 more Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scripting CVE-2021-24940 6.1 MediumMarch 14, 2022
• Show olderLoading…