Product by Automattic

    Automattic WooCommerce

    18 known vulnerabilities in Automattic WooCommerce (Automattic), 0 of them actively exploited (CISA KEV).

    Key figures

    18

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    0

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Automattic WooCommerce (Automattic)
    HighCVE-2017-17058

    Automattic WooCommerce: Path Traversal

    		7.5
    HighCVE-2026-48888

    WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability

    		7.5
    HighCVE-2026-57777

    WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

    		7.6
    HighCVE-2026-106608

    WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability

    		7.2
    MediumCVE-2023-47777

    Automattic WooCommerce: Cross-site Scripting

    also in 1 other product

    		6.5
    HighCVE-2026-3589

    WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

    		7.5
    MediumCVE-2025-5062

    WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting

    also in 1 other product

    		6.1
    MediumCVE-2024-9944

    WooCommerce <= 9.0.2 - Unauthenticated HTML Injection

    also in 1 other product

    		5.3
    MediumCVE-2024-1310

    WooCommerce < 8.6 - Contributor+ Private/Draft Products Access

    		4.9
    MediumCVE-2025-15033

    WooCommerce - Subscriber/Customer+ Order Data Disclosure

    		6.5
    MediumCVE-2021-24323

    Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)

    also in 1 other product

    		4.8
    MediumCVE-2024-39666

    WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability

    		5.9
    MediumCVE-2023-7320

    WooCommerce <= 7.8.2 - Sensitive Information Exposure

    		5.3
    MediumCVE-2025-49042

    WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability

    		5.9
    MediumCVE-2025-26762

    WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability

    		5.9
    LowCVE-2024-35777

    WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability

    		3.5
    HighCVE-2023-52222

    WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

    also in 1 other product

    		4.3
    MediumCVE-2024-22155

    WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability

    		4.3

    All products by Automattic