| CVE-2026-106608 |
Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This…
|
7.2
High
|
Oct 10, 2026 |
| CVE-2026-48888 |
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS
|
7.5
High
|
Sep 8, 2026 |
| CVE-2026-57777 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic…
|
7.6
High
|
Sep 4, 2026 |
| CVE-2026-3589 |
The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could…
|
7.5
High
|
Mar 6, 2026 |
| CVE-2025-15033 |
A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on…
|
6.5
Medium
|
Dec 22, 2025 |
| CVE-2023-7320 |
The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including,…
|
5.3
Medium
|
Oct 29, 2025 |
| CVE-2025-49042 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic…
|
5.9
Medium
|
Oct 29, 2025 |
| CVE-2025-5062 |
The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store'…
|
6.1
Medium
|
May 22, 2025 |
| CVE-2025-26762 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic…
|
5.9
Medium
|
Mar 27, 2025 |
| CVE-2024-10486 |
The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and…
|
5.3
Medium
|
Nov 18, 2024 |
| CVE-2024-9944 |
The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2
|
5.3
Medium
|
Oct 15, 2024 |
| CVE-2024-39666 |
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in…
|
5.9
Medium
|
Aug 18, 2024 |
| CVE-2024-35777 |
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in…
|
3.5
Low
|
Jul 9, 2024 |
| CVE-2024-22155 |
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a…
|
4.3
Medium
|
Apr 7, 2024 |
| CVE-2023-52222 |
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a…
|
4.3
Medium
|
Jan 8, 2024 |
| CVE-2023-47777 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic…
|
6.5
Medium
|
Nov 30, 2023 |
| CVE-2021-24323 |
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output…
|
Not rated
|
May 17, 2021 |
| CVE-2017-17058 |
The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a…
|
7.5
High
|
Nov 29, 2017 |