Vendor

    WooCommerce

    89 known vulnerabilities in products by WooCommerce, 0 of them actively exploited (CISA KEV).

    Key figures

    89

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in WooCommerce
    CriticalCVE-2021-24212

    WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE

    		9.8
    HighCVE-2021-32789

    Woocommerce-gutenberg-products-block: SQL Injection

    also in 1 other product

    		7.5
    CriticalCVE-2022-50972

    WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php

    		9.8
    MediumCVE-2019-7441

    WooCommerce Paypal Checkout Payment Gateway: security vulnerability

    		6.5
    HighCVE-2020-35627

    WooCommerce Gift Cards: Code Execution

    		8.8
    HighCVE-2017-18356

    WooCommerce: security vulnerability

    		8.8
    MediumCVE-2020-29156

    WooCommerce: security vulnerability

    		5.3
    HighCVE-2018-20714

    WooCommerce: Privilege Escalation

    		8.1
    CriticalCVE-2023-33318

    WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File Upload

    		9.9
    HighCVE-2023-34000

    WooCommerce Stripe Payment Gateway: Authorization Bypass Through User-Controlled Key

    		7.5
    MediumCVE-2019-18834

    WooCommerce Subscriptions: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2023-33331

    WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL Injection

    also in 1 other product

    		8.5
    MediumCVE-2021-24940

    Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scripting

    		6.1
    HighCVE-2020-11497

    WooCommerce Nab Transact: security vulnerability

    		7.5
    HighCVE-2026-9284

    WooCommerce PayPal Payments: Missing Authorization

    		8.2
    MediumCVE-2016-10987

    Woocommerce Persian Woocommerce SMS: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2023-35876

    WooCommerce Square: Authorization Bypass Through User-Controlled Key

    also in 1 other product

    		8.1
    HighCVE-2023-33330

    WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL Injection

    		8.5
    HighCVE-2023-32795

    WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection

    		8.2
    MediumCVE-2015-2329

    WooCommerce: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2023-37871

    WooCommerce GoCardless: Authorization Bypass Through User-Controlled Key

    also in 1 other product

    		8.2
    HighCVE-2023-35881

    WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability

    		7.6
    MediumCVE-2019-14978

    WooCommerce Payu India Payment Gateway: security vulnerability

    		5.3
    MediumCVE-2021-32790

    Blind SQL Injection possible via Authenticated Web-hook Search API Endpoint

    		4.9
    MediumCVE-2024-10486

    Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File

    		5.3

    All vulnerabilities in search

    Products

    Products by WooCommerce
    WooCommerce170
    WooCommerce AutomateWoo70
    WooCommerce Shipping Multiple Addresses70
    WooCommerce Pre-Orders60
    Woocommerce Stripe Payment Gateway50
    Product Vendors40
    WooCommerce Returns and Warranty Requests40
    Woocommerce Box Office30
    Woocommerce Brands30
    Woocommerce Paypal Payments30
    WooCommerce Stripe Payment Gateway30