CVE-2025-14073WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure Exploitation status Not known exploited Fix Affected product W WooCommerce PayPal Payments Published 08/01/2026 Severity Medium CVE-2022-50972WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php Exploitation status Public exploit Fix Not confirmed Affected product W WooCommerce Published 06/20/2026 Severity Critical CVE-2026-2381WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter Exploitation status Not known exploited Fix Affected product W WooCommerce Stripe Payment Gateway Published 06/16/2026 Severity Medium CVE-2026-9284WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure Exploitation status Not known exploited Fix Affected product W WooCommerce PayPal Payments Published 05/23/2026 Severity High CVE-2026-1710WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax Exploitation status Not known exploited Fix Affected product W WooPayments: Integrated WooCommerce Payments Published 03/31/2026 Severity Medium CVE-2025-13457WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id Exploitation status Not known exploited Fix Affected product W WooCommerce Square Published 01/10/2026 Severity High CVE-2025-5062WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting Exploitation status Not known exploited Fix Affected product W WooCommerce Published 05/22/2025 Severity Medium CVE-2024-10486Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File Exploitation status Not known exploited Fix Affected product G Google for WooCommerce Published 11/18/2024 Severity Medium CVE-2020-36841WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation Exploitation status Not known exploited Fix Affected product W WooCommerce Smart Coupons Published 10/16/2024 Severity Medium CVE-2017-20193Product Vendors <= 2.0.35 - Reflected Cross Site Scripting Exploitation status Not known exploited Fix Affected product P Product Vendors Published 10/16/2024 Severity Medium CVE-2024-9944WooCommerce <= 9.0.2 - Unauthenticated HTML Injection Exploitation status Not known exploited Fix Affected product W WooCommerce Published 10/15/2024 Severity Medium CVE-2023-35049WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Stripe Payment Gateway Published 06/19/2024 Severity High CVE-2023-51495WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Warranty Requests Published 06/14/2024 Severity Medium CVE-2023-51496WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Warranty Requests Published 06/14/2024 Severity Medium CVE-2023-51497WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.9 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Ship to Multiple Addresses Published 06/14/2024 Severity Medium CVE-2024-37297WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms Exploitation status Not known exploited Fix Not confirmed Affected product W woocommerce Published 06/12/2024 Severity Medium CVE-2023-34003WordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Box Office Published 06/09/2024 Severity Medium CVE-2023-51494WordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Product Vendors Published 06/09/2024 Severity Medium CVE-2023-35881WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce One Page Checkout Published 05/17/2024 Severity High CVE-2023-51499WordPress WooCommerce Shipping Per Product plugin <= 2.5.4 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Shipping Per Product Published 04/12/2024 Severity Medium CVE-2023-44999WordPress WooCommerce Stripe Gateway plugin <= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Stripe Payment Gateway Published 03/27/2024 Severity Medium CVE-2024-24799WordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Box Office Published 03/26/2024 Severity Medium CVE-2024-27193WordPress PayU India plugin <= 3.8.8 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product P PayU India Published 03/15/2024 Severity High CVE-2022-0775WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion Exploitation status Public exploit Fix Affected product W WooCommerce Published 01/16/2024 Severity Medium CVE-2023-52222WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product W WooCommerce Published 01/08/2024 Severity Medium CVE-2023-51502WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not known exploited Fix Affected product W WooCommerce Stripe Payment Gateway Published 01/05/2024 Severity High CVE-2023-32795WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection Exploitation status Not known exploited Fix Affected product P Product Add-Ons Published 12/28/2023 Severity High CVE-2023-32799WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not confirmed Fix Affected product S Shipping Multiple Addresses Published 12/21/2023 Severity Medium CVE-2023-32747WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not known exploited Fix Affected product W WooCommerce Bookings Published 12/21/2023 Severity Medium CVE-2023-33318WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File Upload Exploitation status Not confirmed Fix Affected product A AutomateWoo Published 12/20/2023 Severity Critical CVE-2023-32743WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL Injection Exploitation status Not confirmed Fix Affected product A AutomateWoo Published 12/20/2023 Severity High CVE-2023-33330WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL Injection Exploitation status Not known exploited Fix Affected product A AutomateWoo Published 12/20/2023 Severity High CVE-2023-35914WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not confirmed Fix Affected product W Woo Subscriptions Published 12/20/2023 Severity High CVE-2023-35876WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not confirmed Fix Affected product W WooCommerce Square Published 12/20/2023 Severity High CVE-2023-37871WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not confirmed Fix Affected product G GoCardless Published 12/20/2023 Severity High CVE-2023-33331WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL Injection Exploitation status Not known exploited Fix Affected product P Product Vendors Published 12/18/2023 Severity High CVE-2023-47789WordPress WooCommerce Canada Post Shipping Plugin <= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not confirmed Fix Affected product C Canada Post Shipping Method Published 12/18/2023 Severity Medium CVE-2023-47787WordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product W WooCommerce Bookings Published 12/18/2023 Severity Medium CVE-2023-32744WordPress WooCommerce Product Recommendations Plugin < 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product P Product Recommendations Published 11/09/2023 Severity Medium CVE-2023-32745WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product A AutomateWoo Published 11/09/2023 Severity Medium CVE-2023-32794WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product P Product Add-Ons Published 11/09/2023 Severity Medium CVE-2023-35879WordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL Injection Exploitation status Not known exploited Fix Affected product P Product Vendors Published 10/31/2023 Severity High CVE-2023-34004WordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product W WooCommerce Box Office Published 08/30/2023 Severity Medium CVE-2023-33317WordPress WooCommerce Warranty Requests Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product R Returns and Warranty Requests Published 08/30/2023 Severity High CVE-2023-32746WordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product W WooCommerce Brands Published 08/30/2023 Severity Medium CVE-2023-32793WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product W WooCommerce Pre-Orders Published 08/30/2023 Severity Medium CVE-2023-32802WordPress WooCommerce Pre-Orders Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product W WooCommerce Pre-Orders Published 08/30/2023 Severity High CVE-2023-32801WordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product C Composite Products Published 08/30/2023 Severity High CVE-2023-32575WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.25 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product P Product page shipping calculator for WooCommerce Published 08/25/2023 Severity Medium CVE-2023-37873WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product S Shipping Multiple Addresses Published 08/05/2023 Severity High CVE-2023-3508WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF Exploitation status Public exploit Fix Affected product W WooCommerce Pre-Orders Published 07/31/2023 Severity Medium CVE-2023-3507WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF Exploitation status Public exploit Fix Affected product W WooCommerce Pre-Orders Published 07/31/2023 Severity Medium CVE-2023-36514WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product S Shipping Multiple Addresses Published 07/17/2023 Severity Medium CVE-2023-36513WordPress AutomateWoo Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product A AutomateWoo Published 07/17/2023 Severity Medium CVE-2023-36511WordPress WooCommerce Order Barcodes Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product W WooCommerce Order Barcodes Published 07/17/2023 Severity Medium CVE-2023-35880WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product W WooCommerce Brands Published 07/17/2023 Severity Medium CVE-2023-35917WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product W WooCommerce PayPal Payments Published 06/22/2023 Severity Medium CVE-2023-35918WordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product B Bulk Stock Management Published 06/22/2023 Severity High CVE-2023-34000WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not known exploited Fix Affected product W WooCommerce Stripe Payment Gateway Published 06/14/2023 Severity High CVE-2015-10115WooSidebars Sidebar Manager Converter Plugin class-woosidebars-sbm-converter.php process_request redirect Exploitation status Not confirmed Fix Affected product W WooSidebars Sidebar Manager Converter Plugin Published 06/05/2023 Severity Medium CVE-2015-10114WooSidebars Plugin class-woo-sidebars.php enable_custom_post_sidebars redirect Exploitation status Not confirmed Fix Affected product W WooSidebars Plugin Published 06/05/2023 Severity Medium CVE-2015-10113WooFramework Tweaks Plugin wooframework-tweaks.php admin_screen_logic redirect Exploitation status Not confirmed Fix Affected product W WooFramework Tweaks Plugin Published 06/05/2023 Severity Low CVE-2015-10112WooFramework Branding Plugin wooframework-branding.php admin_screen_logic redirect Exploitation status Not confirmed Fix Affected product W WooFramework Branding Plugin Published 06/05/2023 Severity Medium CVE-2023-33332WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product W WooCommerce Product Vendors Published 05/28/2023 Severity High CVE-2023-33319WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product W WooCommerce Follow-Up Emails (AutomateWoo) Published 05/28/2023 Severity High CVE-2023-33316WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product W WooCommerce Follow-Up Emails (AutomateWoo) Published 05/28/2023 Severity Medium CVE-2023-2179WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update Exploitation status Public exploit Fix Not confirmed Affected product W WooCommerce Order Status Change Notifier Published 05/15/2023 Severity Medium CVE-2015-10104Icons for Features Plugin class-icons-for-features-admin.php redirect Exploitation status Not known exploited Fix Affected product I Icons for Features Plugin Published 04/30/2023 Severity Low CVE-2022-2099WooCommerce < 6.6.0 - Admin+ Stored HTML Injection Exploitation status Public exploit Fix Affected product W WooCommerce Published 07/17/2022 Severity Unknown CVE-2021-24940Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scripting Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 03/14/2022 Severity Unknown CVE-2021-24938WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site Scripting Exploitation status Not confirmed Fix Affected product W WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency Published 12/06/2021 Severity Unknown CVE-2021-32790Blind SQL Injection possible via Authenticated Web-hook Search API Endpoint Exploitation status Not confirmed Fix Not confirmed Affected product W woocommerce Published 07/26/2021 Severity Medium CVE-2021-32789Arbitrary SQL (SQL injection) possible via the Store API component. Exploitation status Not confirmed Fix Not confirmed Affected product W woocommerce-gutenberg-products-block Published 07/26/2021 Severity High CVE-2021-24323Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS) Exploitation status Not confirmed Fix Affected product W WooCommerce Published 05/17/2021 Severity Unknown CVE-2021-24212WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE Exploitation status Not confirmed Fix Affected product W WooCommerce Help Scout Published 04/05/2021 Severity Unknown CVE-2020-35627Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 12/28/2020 Severity Unknown CVE-2020-29156Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 12/27/2020 Severity Unknown CVE-2020-11497Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 08/26/2020 Severity Unknown CVE-2019-18834Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 07/23/2020 Severity Unknown CVE-2019-20891Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 06/19/2020 Severity Unknown CVE-2016-10987Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 09/17/2019 Severity Unknown CVE-2019-14979Exploitation status Not known exploited Fix Not confirmed Affected product Not confirmed Published 08/29/2019 Severity Unknown CVE-2019-14978Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 08/29/2019 Severity Unknown CVE-2019-7441Exploitation status Public exploit Fix Not confirmed Affected product Not confirmed Published 03/20/2019 Severity Unknown CVE-2019-9168Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 02/26/2019 Severity Unknown CVE-2018-20714Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 01/15/2019 Severity Unknown CVE-2017-18356Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 01/15/2019 Severity Unknown CVE-2015-2329Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 02/08/2018 Severity Unknown CVE-2016-10112Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 01/04/2017 Severity Unknown 
.svg){kind=icon}
