# cve.now: Woocommerce

The newest entries naming Woocommerce as an affected vendor (up to 200), of 51 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-14073](https://cve.now/CVE-2025-14073.md): WooCommerce PayPal Payments \<= 3.3.2 - Unauthenticated Sensitive Information Disclosure (CVSS 5.3)
- [CVE-2022-50972](https://cve.now/CVE-2022-50972.md): WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php (CVSS 9.3)
- [CVE-2026-2381](https://cve.now/CVE-2026-2381.md): WooCommerce Stripe Payment Gateway \<= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter (CVSS 6.5)
- [CVE-2026-9284](https://cve.now/CVE-2026-9284.md): WooCommerce PayPal Payments \<= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure (CVSS 8.2)
- [CVE-2026-1710](https://cve.now/CVE-2026-1710.md): WooPayments \<= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save\_upe\_appearance\_ajax (CVSS 6.5)
- [CVE-2025-13457](https://cve.now/CVE-2025-13457.md): WooCommerce Square \<= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get\_token\_by\_id (CVSS 7.5)
- [CVE-2024-10486](https://cve.now/CVE-2024-10486.md): Google for WooCommerce \<= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File (CVSS 5.3)
- [CVE-2020-36841](https://cve.now/CVE-2020-36841.md): WooCommerce Smart Coupons \<= 4.6.0 - Unauthenticated Coupon Creation (CVSS 5.3)
- [CVE-2017-20193](https://cve.now/CVE-2017-20193.md): Product Vendors \<= 2.0.35 - Reflected Cross Site Scripting (CVSS 4.7)
- [CVE-2023-35049](https://cve.now/CVE-2023-35049.md): WordPress WooCommerce Stripe Payment Gateway plugin \<= 7.4.0 - Unauthenticated Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2024-37297](https://cve.now/CVE-2024-37297.md): WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms (CVSS 5.4)
- [CVE-2023-35881](https://cve.now/CVE-2023-35881.md): WordPress WooCommerce One Page Checkout plugin \<= 2.3.0 - Local File Inclusion vulnerability (CVSS 7.6)
- [CVE-2023-51499](https://cve.now/CVE-2023-51499.md): WordPress WooCommerce Shipping Per Product plugin \<= 2.5.4 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-44999](https://cve.now/CVE-2023-44999.md): WordPress WooCommerce Stripe Gateway plugin \<= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-24799](https://cve.now/CVE-2024-24799.md): WordPress WooCommerce Box Office plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2023-51502](https://cve.now/CVE-2023-51502.md): WordPress WooCommerce Stripe Payment Gateway Plugin \<= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 7.5)
- [CVE-2023-32795](https://cve.now/CVE-2023-32795.md): WordPress WooCommerce Product Add-ons Plugin \<= 6.1.3 is vulnerable to PHP Object Injection (CVSS 8.2)
- [CVE-2023-32799](https://cve.now/CVE-2023-32799.md): WordPress WooCommerce Ship to Multiple Addresses Plugin \<= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 6.5)
- [CVE-2023-32747](https://cve.now/CVE-2023-32747.md): WordPress WooCommerce Bookings Plugin \<= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 5.4)
- [CVE-2023-33318](https://cve.now/CVE-2023-33318.md): WordPress WooCommerce Follow-Up Emails Plugin \<= 4.9.40 is vulnerable to Arbitrary File Upload (CVSS 9.9)
- [CVE-2023-32743](https://cve.now/CVE-2023-32743.md): WordPress AutomateWoo Plugin \<= 5.7.1 is vulnerable to SQL Injection (CVSS 7.6)
- [CVE-2023-33330](https://cve.now/CVE-2023-33330.md): WordPress WooCommerce Follow-Up Emails Plugin \<= 4.9.50 is vulnerable to SQL Injection (CVSS 8.5)
- [CVE-2023-35914](https://cve.now/CVE-2023-35914.md): WordPress WooCommerce Subscriptions Plugin \<= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 7.5)
- [CVE-2023-35876](https://cve.now/CVE-2023-35876.md): WordPress WooCommerce Square Plugin \<= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 8.1)
- [CVE-2023-37871](https://cve.now/CVE-2023-37871.md): WordPress WooCommerce GoCardless Gateway Plugin \<= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 8.2)
- [CVE-2023-33331](https://cve.now/CVE-2023-33331.md): WordPress WooCommerce Product Vendors Plugin \<= 2.1.76 is vulnerable to SQL Injection (CVSS 8.5)
- [CVE-2023-47789](https://cve.now/CVE-2023-47789.md): WordPress WooCommerce Canada Post Shipping Plugin \<= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-47787](https://cve.now/CVE-2023-47787.md): WordPress WooCommerce Bookings Plugin \<= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-32744](https://cve.now/CVE-2023-32744.md): WordPress WooCommerce Product Recommendations Plugin \< 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-32745](https://cve.now/CVE-2023-32745.md): WordPress AutomateWoo Plugin \<= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-32794](https://cve.now/CVE-2023-32794.md): WordPress WooCommerce Product Add-ons Plugin \<= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-35879](https://cve.now/CVE-2023-35879.md): WordPress WooCommerce Product Vendors Plugin \<= 2.1.78 is vulnerable to SQL Injection (CVSS 7.6)
- [CVE-2023-34004](https://cve.now/CVE-2023-34004.md): WordPress WooCommerce Box Office Plugin \<= 1.1.50 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-33317](https://cve.now/CVE-2023-33317.md): WordPress WooCommerce Warranty Requests Plugin \<= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-32746](https://cve.now/CVE-2023-32746.md): WordPress WooCommerce Brands Plugin \<= 1.6.45 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-32793](https://cve.now/CVE-2023-32793.md): WordPress WooCommerce Pre-Orders Plugin \<= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-32802](https://cve.now/CVE-2023-32802.md): WordPress WooCommerce Pre-Orders Plugin \<= 1.9.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-32801](https://cve.now/CVE-2023-32801.md): WordPress WooCommerce Composite Products Plugin \<= 8.7.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-37873](https://cve.now/CVE-2023-37873.md): WordPress WooCommerce Ship to Multiple Addresses Plugin \<= 3.8.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-36514](https://cve.now/CVE-2023-36514.md): WordPress WooCommerce Ship to Multiple Addresses Plugin \<= 3.8.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.5)
- [CVE-2023-36513](https://cve.now/CVE-2023-36513.md): WordPress AutomateWoo Plugin \<= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-36511](https://cve.now/CVE-2023-36511.md): WordPress WooCommerce Order Barcodes Plugin \<= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-35880](https://cve.now/CVE-2023-35880.md): WordPress WooCommerce Brands Plugin \<= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-35917](https://cve.now/CVE-2023-35917.md): WordPress WooCommerce PayPal Payments Plugin \<= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-35918](https://cve.now/CVE-2023-35918.md): WordPress WooCommerce Bulk Stock Management Plugin \<= 2.2.33 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-34000](https://cve.now/CVE-2023-34000.md): WordPress WooCommerce Stripe Payment Gateway Plugin \<= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 7.5)
- [CVE-2023-33332](https://cve.now/CVE-2023-33332.md): WordPress WooCommerce Product Vendors Plugin \<= 2.1.76 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-33319](https://cve.now/CVE-2023-33319.md): WordPress WooCommerce Follow-Up Emails Plugin \<= 4.9.40 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-33316](https://cve.now/CVE-2023-33316.md): WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin \<= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2021-32790](https://cve.now/CVE-2021-32790.md): Blind SQL Injection possible via Authenticated Web-hook Search API Endpoint (CVSS 4.9)
- [CVE-2021-32789](https://cve.now/CVE-2021-32789.md): Arbitrary SQL (SQL injection) possible via the Store API component. (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/woocommerce
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.