Woocommerce vulnerabilities
89 vulnerabilities
Known vulnerabilities in Woocommerce products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 48 products.
Products
47 of 48- Woocommerce17 vulnerabilities
- Automatewoo7 vulnerabilities
- Woocommerce Stripe Payment Gateway5 vulnerabilities
- Product Vendors4 vulnerabilities
- Shipping Multiple Addresses4 vulnerabilities
- Woocommerce Pre Orders4 vulnerabilities
- Returns And Warranty Requests3 vulnerabilities
- Stripe Payment Gateway3 vulnerabilities
- Woocommerce Paypal Payments3 vulnerabilities
- Box Office2 vulnerabilities
- Paypal Checkout Payment Gateway2 vulnerabilities
- Payu India Payment Gateway2 vulnerabilities
- Product Add Ons2 vulnerabilities
- Product Addons2 vulnerabilities
- Woocommerce Bookings2 vulnerabilities
- Woocommerce Box Office2 vulnerabilities
- Woocommerce Brands2 vulnerabilities
- Woocommerce Follow Up Emails (Automatewoo)2 vulnerabilities
- Woocommerce Square2 vulnerabilities
- Brands1 vulnerabilities
- Bulk Stock Management1 vulnerabilities
- Canada Post Shipping Method1 vulnerabilities
- Composite Products1 vulnerabilities
- Gift Cards1 vulnerabilities
- Gocardless1 vulnerabilities
- Google For Woocommerce1 vulnerabilities
- Help Scout1 vulnerabilities
- Icons For Features1 vulnerabilities
- Nab Transact1 vulnerabilities
- Paypal Payments1 vulnerabilities
- Persian Woocommerce Sms1 vulnerabilities
- Persian Woocommerce1 vulnerabilities
- Product Recommendations1 vulnerabilities
- Sidebar Manager To Woosidebars Converter1 vulnerabilities
- Subscriptions1 vulnerabilities
- Woo Subscriptions1 vulnerabilities
- Woocommerce Currency Switcher1 vulnerabilities
- Woocommerce One Page Checkout1 vulnerabilities
- Woocommerce Order Barcodes1 vulnerabilities
- Woocommerce Order Status Change Notifier1 vulnerabilities
- Woocommerce Product Vendors1 vulnerabilities
- Woocommerce Shipping Per Product1 vulnerabilities
- Woocommerce Smart Coupons1 vulnerabilities
- Woocommerce Gutenberg Products Block1 vulnerabilities
- Wooframework Branding1 vulnerabilities
- Wooframework Tweaks1 vulnerabilities
- Woosidebars1 vulnerabilities
CVE-2018-20714woocommercewoocommerce+1
EPSS score1.84%
The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of woocommerce.php, which leads to certain privilege checks not being in place, and therefore a shop manager can escalate privileges to admin.CVE-2021-24323automatticwoocommerce+2EPSS score0.74%
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabledCVE-2021-24938unknownwoocs – currency switcher for woocommerce. professional and free multi currency plugin – pay in selected currency+2EPSS score0.82%
The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issueCVE-2021-24212unknownwoocommerce help scout+2EPSS score7.91%
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp.CVE-2021-24940unknownووکامرس فارسی+2EPSS score1.44%
The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issueCVE-2021-32790woocommercewoocommerce+1EPSS score1.26%
Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading.CVE-2021-32789automatticwoocommerce_blocks+2EPSS score17.23%
woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.CVE-2015-2329woocommercewoocommerce+1EPSS score1.15%
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order.CVE-2015-10115woocommercesidebar_manager_to_woosidebars_converter+1EPSS score0.70%
A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. This affects the function process_request of the file classes/class-woosidebars-sbm-converter.php. The manipulation leads to open redirect. It is possible to initiate the attack remotely. Upgrading to version 1.1.2 is able to address this issue. The patch is named a0efb4ffb9dfe2925b889c1aa5ea40b4abbbda8a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230655.CVE-2015-10112woocommercewooframework_branding+1EPSS score0.66%
A vulnerability classified as problematic has been found in WooFramework Branding Plugin up to 1.0.1 on WordPress. Affected is the function admin_screen_logic of the file wooframework-branding.php. The manipulation of the argument url leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is f12fccd7b5eaf66442346f748c901ef504742f78. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230652.CVE-2015-10113woocommercewooframework_tweaks+1EPSS score0.46%
A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admin_screen_logic of the file wooframework-tweaks.php. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is 3b57d405149c1a59d1119da6e0bb8212732c9c88. It is recommended to upgrade the affected component. The identifier VDB-230653 was assigned to this vulnerability.CVE-2015-10114woocommercewoosidebars+1EPSS score0.67%
A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue is the function enable_custom_post_sidebars of the file classes/class-woo-sidebars.php. The manipulation of the argument sendback leads to open redirect. The attack may be launched remotely. Upgrading to version 1.4.2 is able to address this issue. The patch is identified as 1ac6d6ac26e185673f95fc1ccc56a392169ba601. It is recommended to upgrade the affected component. VDB-230654 is the identifier assigned to this vulnerability.CVE-2015-10104woocommerceicons_for_features+1EPSS score0.55%
A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipulation of the argument redirect_url leads to open redirect. The attack may be launched remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 63124c021ae24b68e56872530df26eb4268ad633. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227756.CVE-2016-10112woocommercewoocommerce+1EPSS score0.90%
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by providing crafted tax-rate table values in CSV format.CVE-2016-10987woocommercepersian_woocommerce_sms+1EPSS score1.36%
The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.CVE-2025-13457woocommercewoocommerce square+1EPSS score0.34%
The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_id function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Square "ccof" (credit card on file) values and leverage this value to potentially make fraudulent charges on the target site.CVE-2025-14073woocommercewoocommerce paypal payments+1EPSS score0.40%
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the `enqueue_paypal_insights_script_on_order_received()` function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to obtain sensitive order information including order keys, which can then be leveraged to access full customer billing details (name, email, phone, address) via the WooCommerce Store API within a 10-minute grace period after order creation.CVE-2025-5062automatticwoocommerce+2EPSS score0.46%
The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and including, 9.4.2 due to insufficient input sanitization and output escaping on PostMessage data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.CVE-2020-11497woocommercenab_transact+1EPSS score1.15%
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step.CVE-2020-36841woocommercewoocommerce smart coupons+1EPSS score0.21%
The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates of any value, which could be redeemed for products sold on the victim’s storefront.