Woocommerce

89 CVEs across 58 Woocommerce products. Browse Woocommerce vulnerabilities, severities, and proof-of-concept exploits.

Woocommerce products with known CVEs

ProductCVEs
Woocommerce17
Automatewoo7
Woocommerce Stripe Payment Gateway5
Shipping Multiple Addresses4
Woocommerce Pre-Orders4
Product Vendors3
Returns And Warranty Requests3
Shipping Multiple Addresses3
Stripe Payment Gateway3
Woocommerce Paypal Payments3
Box Office2
Paypal Checkout Payment Gateway2
Payu India Payment Gateway2
Product Add-Ons2
Product Addons2
Woocommerce Bookings2
Woocommerce Box Office2
Woocommerce Brands2
Woocommerce Follow-Up Emails (Automatewoo)2
Woocommerce Pre-Orders2
Woocommerce Square2
Brands1
Bulk Stock Management1
Bulk Stock Management1
Canada Post Shipping Method1
Composite Products1
Composite Products1
Gift Cards1
Gocardless1
Google For Woocommerce1
Help Scout1
Icons For Features1
Nab Transact1
Paypal Payments1
Persian-Woocommerce1
Persian Woocommerce Sms1
Product Recommendations1
Product Recommendations1
Product Vendors1
Returns And Warranty Requests1
Sidebar Manager To Woosidebars Converter1
Subscriptions1
Woocommerce Box Office1
Woocommerce Brands1
Woocommerce Currency Switcher1
Woocommerce-Gutenberg-Products-Block1
Woocommerce One Page Checkout1
Woocommerce Order Barcodes1
Woocommerce Order Barcodes1
Woocommerce Order Status Change Notifier1
Woocommerce CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-14073Medium5.32026-08-01The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versio…
CVE-2022-50972Critical9.82026-06-20WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the pr…
CVE-2026-2381Medium6.52026-06-16The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_p…
CVE-2026-9284High8.22026-05-23The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization c…
CVE-2026-1710Medium6.52026-03-31The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t…
CVE-2025-13457High7.52026-01-10The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_…
CVE-2025-5062Medium6.12025-05-22The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and includin…
CVE-2024-10486Medium5.32024-11-18The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly ac…
CVE-2020-36841Medium5.32024-10-16The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init…
CVE-2017-20193Medium4.72024-10-16The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insu…
CVE-2024-9944Medium5.32024-10-15The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutra…
CVE-2023-35049High7.52024-06-19Missing Authorization vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7…
CVE-2023-51497Medium5.42024-06-14Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3…
CVE-2023-51496Medium5.32024-06-14Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
CVE-2023-51495Medium6.52024-06-14Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.
CVE-2024-37297Medium5.42024-06-12WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad acto…
CVE-2023-34003Medium6.52024-06-09Missing Authorization vulnerability in Woo WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.1.51.
CVE-2023-51494Medium5.32024-06-09Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.1.
CVE-2023-35881High7.62024-05-17Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout allows PHP Local File…
CVE-2023-51499Medium4.32024-04-12Missing Authorization vulnerability in WooCommerce WooCommerce Shipping Per Product.This issue affects WooCommerce Shipping Per Product: from n/a through 2.5.4.
CVE-2023-44999Medium5.42024-03-27Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n…
CVE-2024-24799Medium6.52024-03-26Missing Authorization vulnerability in WooCommerce WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.2.2.
CVE-2024-27193High7.12024-03-15Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PayU India PayU India payu-india allows DOM-Based XSS.Thi…
CVE-2022-0775Medium4.32024-01-16The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such a…
CVE-2023-52222Medium4.32024-01-08Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2.
CVE-2023-51502High7.52024-01-05Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment…
CVE-2023-32795High8.22023-12-28Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.
CVE-2023-32799Medium6.52023-12-21Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from…
CVE-2023-32747Medium5.42023-12-21Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1…
CVE-2023-33318Critical9.92023-12-20Unrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.40.
CVE-2023-35914High7.52023-12-20Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.
CVE-2023-33330High8.52023-12-20Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: f…
CVE-2023-32743High7.62023-12-20Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: f…
CVE-2023-35876High8.12023-12-20Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.
CVE-2023-37871High8.22023-12-20Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.
CVE-2023-33331High8.52023-12-18Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This iss…
CVE-2023-47789Medium4.32023-12-18Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8…
CVE-2023-47787Medium4.32023-12-18Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3.
CVE-2023-32794Medium5.42023-11-09Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Add-Ons plugin <= 6.1.3 versions.
CVE-2023-32745Medium5.42023-11-09Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.1 versions.
CVE-2023-32744Medium5.42023-11-09Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Recommendations plugin <= 2.3.0 versions.
CVE-2023-35879High7.62023-10-31Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This iss…
CVE-2023-34004Medium6.52023-08-30Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Box Office plugin <= 1.1.50 versions.
CVE-2023-33317High7.12023-08-30Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Returns and Warranty Requests plugin <= 2.1.6 versions.
CVE-2023-32802High7.12023-08-30Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 1.9.0 versions.
CVE-2023-32801High7.12023-08-30Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Composite Products plugin <= 8.7.5 versions.
CVE-2023-32793Medium6.52023-08-30Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 2.0.0 versions.
CVE-2023-32746Medium6.52023-08-30Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45 versions.
CVE-2023-32575Medium5.92023-08-25Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.25 versions.
CVE-2023-37873High7.12023-08-05Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.
CVE-2023-3508Medium6.52023-07-31The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in…
CVE-2023-3507Medium6.52023-07-31The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admin…
CVE-2023-36514Medium6.52023-07-17Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.
CVE-2023-36513Medium5.42023-07-17Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions.
CVE-2023-36511Medium4.32023-07-17Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Order Barcodes plugin <= 1.6.4 versions.
CVE-2023-35880Medium5.42023-07-17Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.49 versions.
CVE-2023-35918High7.12023-06-22Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Bulk Stock Management plugin <= 2.2.33 versions.
CVE-2023-35917Medium4.32023-06-22Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions.
CVE-2023-34000High7.52023-06-14Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin <= 7.4.0 versions.
CVE-2015-10115Medium4.32023-06-05A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. This affects the func…
CVE-2015-10114Medium4.32023-06-05A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue is the function ena…
CVE-2015-10113Low3.52023-06-05A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admi…
CVE-2015-10112Medium4.32023-06-05A vulnerability classified as problematic has been found in WooFramework Branding Plugin up to 1.0.1 on WordPress. Affected is the function admin_screen_logic…
CVE-2023-33332High7.12023-05-28Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.
CVE-2023-33319High7.12023-05-28Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.
CVE-2023-33316Medium5.42023-05-28Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.
CVE-2023-2179Medium6.52023-05-15The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action…
CVE-2015-10104Low3.52023-04-30A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown fu…
CVE-2022-2099Medium4.82022-07-17The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
CVE-2021-24940Medium6.12022-03-14The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which…
CVE-2021-24938Medium6.12021-12-06The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authen…
CVE-2021-32790Medium4.92021-07-26Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin betwe…
CVE-2021-32789High7.52021-07-26woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running…
CVE-2021-24323Medium4.82021-05-17When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high…
CVE-2021-24212Critical9.82021-04-05The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any…
CVE-2020-35627High8.82020-12-28Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute arbitrary code. Once…
CVE-2020-29156Medium5.32020-12-27The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_st…
CVE-2020-11497High7.52020-08-26An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marke…
CVE-2019-18834Medium6.12020-07-23Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Detai…
CVE-2019-20891High8.82020-06-19WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XS…
CVE-2016-10987Medium6.12019-09-17The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.
CVE-2019-14979Medium5.32019-08-29cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such…
CVE-2019-14978Medium5.32019-08-29/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as…
CVE-2019-7441Medium6.52019-03-21cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such…
CVE-2019-9168Medium6.12019-02-26WooCommerce before 3.5.5 allows XSS via a Photoswipe caption.
CVE-2018-20714High8.12019-01-15The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of wooc…
CVE-2017-18356High8.82019-01-15In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at…
CVE-2015-2329Medium6.12018-02-08Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML vi…
CVE-2016-10112Medium4.82017-01-04Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary we…