Log in Start free

WooCommerce

Products

ProductCVEsExploitedLatest
WooCommerce Stripe Payment Gateway5–Jun 16, 2026
AutomateWoo5–Dec 20, 2023
Shipping Multiple Addresses3–Dec 21, 2023
WooCommerce PayPal Payments3–Aug 1, 2026
WooCommerce3–Jun 20, 2026
WooCommerce Box Office2–Mar 26, 2024
Product Add-Ons2–Dec 28, 2023
Product Vendors2–Dec 18, 2023
WooCommerce Bookings2–Dec 21, 2023
WooCommerce Brands2–Aug 30, 2023
WooCommerce Follow-Up Emails (AutomateWoo)2–May 28, 2023
WooCommerce Pre-Orders2–Aug 30, 2023
WooCommerce Square2–Jan 10, 2026
WooCommerce Shipping Per Product1–Apr 12, 2024
Composite Products1–Aug 30, 2023
WooCommerce Smart Coupons1–Oct 16, 2024
WooPayments: Integrated WooCommerce Payments1–Mar 31, 2026
woocommerce-gutenberg-products-block1–Jul 26, 2021
WooCommerce One Page Checkout1–May 17, 2024
WooCommerce Order Barcodes1–Jul 17, 2023
Canada Post Shipping Method1–Dec 18, 2023
Bulk Stock Management1–Jun 22, 2023
Product Recommendations1–Nov 9, 2023
WooCommerce Product Vendors1–May 28, 2023
Returns and Warranty Requests1–Aug 30, 2023
Google for WooCommerce1–Nov 18, 2024
Woo Subscriptions1–Dec 20, 2023
GoCardless1–Dec 20, 2023

Exploited and recent CVEs

  • CVE-2025-14073 Medium 5.3 WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure 0.5%
  • CVE-2022-50972 Critical 9.8 WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php 1.1%
  • CVE-2026-2381 Medium 6.5 WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter 0.4%
  • CVE-2026-9284 High 8.2 WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure 0.5%
  • CVE-2026-1710 Medium 6.5 WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax 0.3%
  • CVE-2025-13457 High 7.5 WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id 0.3%
  • CVE-2024-10486 Medium 5.3 Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File 0.9%
  • CVE-2020-36841 Medium 5.3 WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation 0.2%
  • CVE-2023-35049 High 7.5 WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability 0.6%
  • CVE-2024-37297 Medium 5.4 WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms 0.5%
  • CVE-2023-35881 High 7.6 WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability 0.7%
  • CVE-2023-51499 Medium 4.3 WordPress WooCommerce Shipping Per Product plugin <= 2.5.4 - Broken Access Control vulnerability 0.4%
  • CVE-2023-44999 Medium 5.4 WordPress WooCommerce Stripe Gateway plugin <= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerability 0.3%
  • CVE-2024-24799 Medium 6.5 WordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerability 0.5%
  • CVE-2023-51502 High 7.5 WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) 0.6%
  • CVE-2023-32795 High 8.2 WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection 0.7%
  • CVE-2023-32799 Medium 6.5 WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR) 0.5%
  • CVE-2023-32747 Medium 5.4 WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR) 0.4%
  • CVE-2023-33318 Critical 9.9 WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File Upload 0.8%
  • CVE-2023-32743 High 7.6 WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL Injection 0.6%
  • CVE-2023-33330 High 8.5 WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL Injection 0.6%
  • CVE-2023-35914 High 7.5 WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR) 0.6%
  • CVE-2023-35876 High 8.1 WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR) 0.8%
  • CVE-2023-37871 High 8.2 WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR) 0.6%
  • CVE-2023-33331 High 8.5 WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL Injection 0.9%
  • CVE-2023-47789 Medium 4.3 WordPress WooCommerce Canada Post Shipping Plugin <= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%
  • CVE-2023-47787 Medium 4.3 WordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%
  • CVE-2023-32744 Medium 5.4 WordPress WooCommerce Product Recommendations Plugin < 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%
  • CVE-2023-32745 Medium 5.4 WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%
  • CVE-2023-32794 Medium 5.4 WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%