Automattic / WooCommerce
14 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-48888 | WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability | HIGH | 7.5 | Sep 8, 2026 |
| CVE-2026-57777 | WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability | HIGH | 7.6 | Sep 4, 2026 |
| CVE-2026-3589 | WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF | HIGH | 7.5 | Mar 6, 2026 |
| CVE-2025-15033 | WooCommerce - Subscriber/Customer+ Order Data Disclosure | MEDIUM | 6.5 | Dec 22, 2025 |
| CVE-2023-7320 | WooCommerce <= 7.8.2 - Sensitive Information Exposure | MEDIUM | 5.3 | Oct 29, 2025 |
| CVE-2025-49042 | WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 5.9 | Oct 29, 2025 |
| CVE-2025-5062 | WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting | MEDIUM | 6.1 | May 22, 2025 |
| CVE-2025-26762 | WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 5.9 | Mar 27, 2025 |
| CVE-2024-10486 | Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File | MEDIUM | 5.3 | Nov 18, 2024 |
| CVE-2024-39666 | WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 5.9 | Aug 18, 2024 |
| CVE-2024-35777 | WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability | LOW | 3.5 | Jul 9, 2024 |
| CVE-2024-1310 | WooCommerce < 8.6 - Contributor+ Private/Draft Products Access | MEDIUM | 4.9 | Apr 15, 2024 |
| CVE-2024-22155 | WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability | MEDIUM | 4.3 | Apr 7, 2024 |
| CVE-2023-52222 | WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) | HIGH | 8.8 | Jan 8, 2024 |
| CVE-2023-47777 | WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | Nov 30, 2023 |
| CVE-2021-24323 | Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS) | MEDIUM | 4.8 | May 17, 2021 |
| CVE-2017-17058 | The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, whi… | HIGH | 7.5 | Nov 29, 2017 |
Showing 1 to 14 of 14 CVEs