Woocommerce vulnerabilities
51 CVEs and advisories name Woocommerce as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-14073WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure
- CVE-2022-50972WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php
- CVE-2026-2381WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter
- CVE-2026-9284WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure
- CVE-2026-1710WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax
- CVE-2025-13457WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id
- CVE-2024-10486Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File
- CVE-2020-36841WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation
- CVE-2017-20193Product Vendors <= 2.0.35 - Reflected Cross Site Scripting
- CVE-2023-35049WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability
- CVE-2024-37297WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms
- CVE-2023-35881WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability
- CVE-2023-51499WordPress WooCommerce Shipping Per Product plugin <= 2.5.4 - Broken Access Control vulnerability
- CVE-2023-44999WordPress WooCommerce Stripe Gateway plugin <= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-24799WordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerability
- CVE-2023-51502WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)
- CVE-2023-32795WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection
- CVE-2023-32799WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR)
- CVE-2023-32747WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR)
- CVE-2023-33318WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File Upload
- CVE-2023-32743WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL Injection
- CVE-2023-33330WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL Injection
- CVE-2023-35914WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)
- CVE-2023-35876WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)
- CVE-2023-37871WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)
- CVE-2023-33331WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL Injection
- CVE-2023-47789WordPress WooCommerce Canada Post Shipping Plugin <= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-47787WordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-32744WordPress WooCommerce Product Recommendations Plugin < 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-32745WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF)