WO
Product
woocommerce
18
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 12Low 0
Watch
Add woocommerce to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-50972 | 9.8 | Jun 20 | WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php Affected: 7.1.0 |
| CVE-2023-52222 | 8.8 | Jan 8 | WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) Affected: through 8.2.2 |
| CVE-2019-20891 | 8.8 | Jun 19 | WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via… Affected: before 3.6.5 |
| CVE-2017-18356 | 8.8 | Jan 15 | In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager… Affected: before 3.2.4 |
| CVE-2018-20714 | 8.1 | Jan 15 | The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability Affected: before 3.4.6 |
| CVE-2024-10567 | 7.5 | Dec 4 | TI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access Affected: through 2.9.1 |
| CVE-2025-5062 | 6.1 | May 22 | WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting Affected: before 9.3.4; 9.4.0 before 9.4.3 |
| CVE-2024-9944 | 6.1 | Oct 15 | WooCommerce <= 9.0.2 - Unauthenticated HTML Injection Affected: before 9.1.0 |
| CVE-2019-9168 | 6.1 | Feb 26 | WooCommerce before 3.5.5 allows XSS via a Photoswipe caption Affected: before 3.5.5 |
| CVE-2015-2329 | 6.1 | Feb 8 | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order Affected: before 2.3.6 |
| CVE-2024-37297 | 5.4 | Jun 12 | WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms Affected: >= 8.8.0, < 8.8.5; >= 8.9.0, < 8.9.3 |
| CVE-2020-29156 | 5.3 | Dec 27 | The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action Affected: before 4.7.0 |
| CVE-2021-32790 | 4.9 | Jul 26 | Woocommerce is an open source eCommerce plugin for WordPress Affected: 3.3.0 before 3.3.6; 3.4.0 before 3.4.8; 3.5.0 before 3.5.9; 3.6.0 before 3.6.6; 3.7.0 before 3.7.2; 3.8.0 before 3.8.2; +17 more |
| CVE-2023-32575 | 4.8 | Aug 25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.25 versions Affected: through 1.3.25 |
| CVE-2022-2099 | 4.8 | Jul 17 | The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles Affected: before 6.6.0 |
| CVE-2021-24323 | 4.8 | May 17 | When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users… Affected: before 5.2.0 |
| CVE-2016-10112 | 4.8 | Jan 4 | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by… Affected: through 2.6.8 |
| CVE-2022-0775 | 4.3 | Jan 16 | WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion Affected: before 6.2.1 |
Showing 18