Skip to contentWoocommerce vulnerabilities
Newest
- automattic canada post shipping methodWordPress WooCommerce Canada Post Shipping Plugin <= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-477894.3 Medium
- automattic woocommerce bookings, woocommerce bookings +1 moreWordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-477874.3 Medium
- woocommerce product recommendationsWordPress WooCommerce Product Recommendations Plugin < 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-327445.4 Medium
- woocommerce automatewooWordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-327455.4 Medium
- woocommerce product add-ons, product addons +1 moreWordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-327945.4 Medium
- woo product vendorsWordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL InjectionCVE-2023-358797.6 High
- woocommerce box officeWordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS)CVE-2023-340046.5 Medium
- woocommerce returns and warranty requestsWordPress WooCommerce Warranty Requests Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)CVE-2023-333177.1 High
- woocommerce brandsWordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)CVE-2023-327466.5 Medium
- unknown woocommerce pre-orders, woocommerce pre-orders +1 moreWordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)CVE-2023-327936.5 Medium
- unknown woocommerce pre-orders, woocommerce pre-orders +1 moreWordPress WooCommerce Pre-Orders Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)CVE-2023-328027.1 High
- woocommerce composite productsWordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS)CVE-2023-328017.1 High
- pi websolution product page shipping calculator for woocommerce, woocommerce +1 moreWordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.25 is vulnerable to Cross Site Scripting (XSS)CVE-2023-325755.9 Medium
- woocommerce shipping multiple addressesWordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Scripting (XSS)CVE-2023-378737.1 High
- unknown woocommerce pre-orders, woocommerce pre-orders +1 moreWooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRFCVE-2023-35086.5 Medium
- unknown woocommerce pre-orders, woocommerce pre-orders +1 moreWooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRFCVE-2023-35076.5 Medium
- woocommerce shipping multiple addressesWordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-365146.5 Medium
- woocommerce automatewooWordPress AutomateWoo Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-365135.4 Medium
- woocommerce order barcodesWordPress WooCommerce Order Barcodes Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-365114.3 Medium
- woocommerce brandsWordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-358805.4 Medium
- woocommerce paypal paymentsWordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-359174.3 Medium
- woocommerce bulk stock managementWordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)CVE-2023-359187.1 High
- woocommerce stripe payment gatewayWordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-340007.5 High
- woocommerce sidebar manager to woosidebars converterWooSidebars Sidebar Manager Converter Plugin class-woosidebars-sbm-converter.php process_request redirectCVE-2015-101154.3 Medium
- woocommerce woosidebarsWooSidebars Plugin class-woo-sidebars.php enable_custom_post_sidebars redirectCVE-2015-101144.3 Medium
- woocommerce wooframework tweaksWooFramework Tweaks Plugin wooframework-tweaks.php admin_screen_logic redirectCVE-2015-101133.5 Low
- woocommerce wooframework brandingWooFramework Branding Plugin wooframework-branding.php admin_screen_logic redirectCVE-2015-101124.3 Medium
- woo woocommerce product vendors, woocommerce product vendors +1 moreWordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS)CVE-2023-333327.1 High
- woocommerce automatewoo, follow-up emails (automatewoo) +1 moreWordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS)CVE-2023-333197.1 High
- woocommerce automatewoo, follow-up emails (automatewoo) +1 moreWordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-333165.4 Medium
- unknown woocommerce order status change notifier, woocommerce order status change notifier +1 moreWooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status UpdateCVE-2023-21796.5 Medium
- woocommerce icons for featuresIcons for Features Plugin class-icons-for-features-admin.php redirectCVE-2015-101043.5 Low
- automattic woocommerceWooCommerce < 6.6.0 - Admin+ Stored HTML InjectionCVE-2022-2099Fix available4.8 Medium
- unknown ووکامرس فارسی, woocommerce persian-woocommerce +1 morePersian Woocommerce <= 5.8.0 - Reflected Cross-Site ScriptingCVE-2021-249406.1 Medium
- woocommerce currency switcher, unknown woocs – currency switcher for woocommerce. professional and free multi currency plugin – pay in selected currency +1 moreWooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site ScriptingCVE-2021-249386.1 Medium
- automattic woocommerceBlind SQL Injection possible via Authenticated Web-hook Search API EndpointCVE-2021-327904.9 Medium
- automattic woocommerce blocks, woocommerce woocommerce-gutenberg-products-block +1 moreArbitrary SQL (SQL injection) possible via the Store API component.CVE-2021-32789Public exploitEPSS 17.2%7.5 High
- automattic woocommerceWoocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)CVE-2021-24323Fix available4.8 Medium
- unknown woocommerce help scout, woocommerce help scout +1 moreWooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCECVE-2021-242129.8 Critical
- woocommerce gift cardsUltimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom...CVE-2020-356278.8 High
- woocommerceWooCommerce Incorrect AuthorizationCVE-2020-29156Fix available5.3 Medium
- woocommerce nab transactAn issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for...CVE-2020-114977.5 High
- woocommerce subscriptionsPersistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote...CVE-2019-188346.1 Medium
- woocommerceWooCommerce Cross-Site Request Forgery (CSRF)CVE-2019-20891Fix available8.8 High
- woocommerce persian woocommerce smsThe persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.CVE-2016-109876.1 Medium
- woocommerce paypal checkout payment gatewaycgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for...CVE-2019-14979Disputed5.3 Medium
- woocommerce payu india payment gateway/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress...CVE-2019-149785.3 Medium
- woocommerce paypal checkout payment gateway** DISPUTED ** cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin...CVE-2019-7441Public exploitDisputed6.5 Medium
- woocommerceWooCommerce before 3.5.5 allows XSS via a Photoswipe caption.CVE-2019-91686.1 Medium
- woocommerceThe logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable...CVE-2018-207148.1 High
- Show moreLoading…