Login Request a demo
WO
Product
woocommerce
by woocommerce · last CVE Jun 20, 2026
18
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 1High 5Medium 12Low 0
Severity
All severities18Critical1High5Medium12Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add woocommerce to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-5062
6.1
0%
May 22
WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting
Affected: before 9.3.4; 9.4.0 before 9.4.3
CVE-2024-9944
6.1
1%
Oct 15
WooCommerce <= 9.0.2 - Unauthenticated HTML Injection
Affected: before 9.1.0
CVE-2019-9168
6.1
1%
Feb 26
WooCommerce before 3.5.5 allows XSS via a Photoswipe caption
Affected: before 3.5.5
CVE-2015-2329
6.1
1%
Feb 8
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order
Affected: before 2.3.6
CVE-2024-37297
5.4
0%
Jun 12
WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms
Affected: >= 8.8.0, < 8.8.5; >= 8.9.0, < 8.9.3
CVE-2020-29156
5.3
4%
Dec 27
The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action
Affected: before 4.7.0
CVE-2021-32790
4.9
1%
Jul 26
Woocommerce is an open source eCommerce plugin for WordPress
Affected: 3.3.0 before 3.3.6; 3.4.0 before 3.4.8; 3.5.0 before 3.5.9; 3.6.0 before 3.6.6; 3.7.0 before 3.7.2; 3.8.0 before 3.8.2; +17 more
CVE-2023-32575
4.8
0%
Aug 25
WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.25 is vulnerable to Cross Site Scripting (XSS)
Affected: through 1.3.25
CVE-2022-2099
4.8
1%
Jul 17
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
Affected: before 6.6.0
CVE-2021-24323
4.8
1%
May 17
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users…
Affected: before 5.2.0
CVE-2016-10112
4.8
1%
Jan 4
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by…
Affected: through 2.6.8
CVE-2022-0775
4.3
1%
Jan 16
WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion
Affected: before 6.2.1
Showing 12