WO
Product
WooCommerce
18
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 6Medium 11Low 1
Watch
Add WooCommerce to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-52222 | 8.8 | Jan 8 | WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) Affected: through 8.2.2 |
| CVE-2026-57777 | 7.6 | Sep 4 | WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability Affected: before 11.0 |
| CVE-2026-48888 | 7.5 | Sep 8 | WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability Affected: before 11.1.0 |
| CVE-2026-3589 | 7.5 | Mar 6 | WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF Affected: 5.4.0 before 5.4.4; 5.5.0 before 5.4.5; 5.6.0 before 5.6.3; 5.7.0 before 5.7.3; 5.8.0 before 5.8.2; 5.9.0 before 5.9.2; +34 more |
| CVE-2017-17058 | 7.5 | Nov 29 | The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent… Affected: through 3.2.6 |
| CVE-2026-106608 | 7.2 | Oct 10 | WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability Affected: 9.8.0 through 11.1.2 |
| CVE-2025-15033 | 6.5 | Dec 22 | WooCommerce - Subscriber/Customer+ Order Data Disclosure Affected: 8.1.0 before 8.1.3; 8.2.0 before 8.2.4; 8.3.0 before 8.3.3; 8.4.0 before 8.4.2; 8.5.0 before 8.5.4; 8.6.0 before 8.6.3; +18 more |
| CVE-2025-5062 | 6.1 | May 22 | WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting Affected: through 9.3.2; 9.4 through 9.4.2 |
| CVE-2024-9944 | 6.1 | Oct 15 | WooCommerce <= 9.0.2 - Unauthenticated HTML Injection Affected: through 9.0.2 |
| CVE-2025-49042 | 5.9 | Oct 29 | WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability Affected: through 10.0.2 |
| CVE-2025-26762 | 5.9 | Mar 27 | WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability Affected: through 9.7.0 |
| CVE-2024-39666 | 5.9 | Aug 18 | WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability Affected: through 9.1.2 |
| CVE-2023-47777 | 5.4 | Nov 30 | WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability Affected: through 8.1.1 |
| CVE-2023-7320 | 5.3 | Oct 29 | WooCommerce <= 7.8.2 - Sensitive Information Exposure Affected: through 7.8.2 |
| CVE-2024-10486 | 5.3 | Nov 18 | Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File Affected: through 2.8.6 |
| CVE-2024-1310 | 4.9 | Apr 15 | WooCommerce < 8.6 - Contributor+ Private/Draft Products Access Affected: before 8.6.0 |
| CVE-2024-22155 | 4.3 | Apr 7 | WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 8.5.2 |
| CVE-2024-35777 | 3.5 | Jul 9 | WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability Affected: through 8.9.2 |
Showing 18