Plugin icon

WooCommerce

woocommerce

Vulnerabilities:

75

Last Updated:

December 22, 2025

Active Installs:

7000000

Published
Title
Fixed in
CVSS
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 9.6.3
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 10.3.7
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 8.7.2
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 9.4.4
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 10.1.3
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 8.5.4
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 9.2.4
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 9.9.6
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 8.3.3
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 9.0.3
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 9.7.2
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 8.1.3
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 10.4.3
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 8.8.6
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 9.5.3
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 10.2.3
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 8.6.3
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 9.3.5
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 10.0.5
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 8.4.2
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 9.1.5
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 9.8.6
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 8.2.4
CVSS
6.5 (medium)
Published
2025-12-22
Title
WooCommerce - Subscriber/Customer+ Order Data Disclosure
Fixed in
Fixed in 8.9.4
CVSS
6.5 (medium)
Published
2025-10-29
Title
WooCommerce < 10.0.3 - Shop manager+ Stored XSS
Fixed in
Fixed in 10.0.3
CVSS
3.5 (low)
Published
2025-07-21
Title
WooCommerce < 10.0 - Shop Manager PII Leak in Multisite
Fixed in
Fixed in 10.0
CVSS
4.9 (medium)
Published
2025-06-19
Title
Wocommerce < 9.9.4 - Shop manager+ SQLi
Fixed in
Fixed in 9.9.4
CVSS
4.1 (medium)
Published
2025-03-04
Title
Woocommerce < 9.7.1 - Shop Manager+ Stored XSS via New Product Form
Fixed in
Fixed in 9.7.1
CVSS
4.8 (medium)
Published
2024-12-03
Title
WooCommerce < 9.4.3 - Reflected XSS
Fixed in
Fixed in 9.4.3
CVSS
7.1 (high)
Published
2024-12-03
Title
WooCommerce < 9.4.3 - Unauthenticated Order Creation
Fixed in
Fixed in 9.4.3
CVSS
5.3 (medium)
Published
2024-10-14
Title
WooCommerce < 9.1.0 - Unauthenticated HTML Injection
Fixed in
Fixed in 9.1.0
CVSS
5.3 (medium)
Published
2024-08-21
Title
WooCommerce < 9.2 - Contributor+ Stored XSS
Fixed in
Fixed in 9.2
CVSS
6.8 (medium)
Published
2024-07-24
Title
WooCommerce < 9.1.4 - Stored XSS
Fixed in
Fixed in 9.1.4
CVSS
3.9 (low)
Published
2024-06-27
Title
WooCommerce < 9.0.0 - Shop Manager+ Content Injection
Fixed in
Fixed in 9.0.0
CVSS
2.7 (low)
Published
2024-06-10
Title
WooCommerce 8.8.0 - 8.9.2 - Reflected XSS
Fixed in
Fixed in 8.9.3
CVSS
7.1 (high)
Published
2024-04-05
Title
WooCommerce < 8.6.0 - Cross-Site Request Forgery
Fixed in
Fixed in 8.6.0
CVSS
4.3 (medium)
Published
2024-03-25
Title
WooCommerce < 8.6 - Contributor+ Private/Draft Products Access
Fixed in
Fixed in 8.6
CVSS
2.7 (low)
Published
2024-01-12
Title
WooCommerce < 8.4.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 8.4.0
CVSS
6.1 (medium)
Published
2024-01-05
Title
WooCommerce < 8.3.0 - Cross-Site Request Forgery
Fixed in
Fixed in 8.3.0
CVSS
4.3 (medium)
Published
2023-11-15
Title
WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute
Fixed in
Fixed in 8.2.0
CVSS
6.4 (medium)
Published
2023-09-11
Title
WooCommerce < 7.9 - Unauthenticated Sensitive Information Disclosure
Fixed in
Fixed in 7.9
CVSS
4.3 (medium)
Published
2023-09-11
Title
WooCommerce < 7.9.0 - Sensitive Information Exposure
Fixed in
Fixed in 7.9.0
CVSS
5.3 (medium)
Published
2023-09-11
Title
WooCommerce < 7.0.1 - Authenticated(Shop Manager+) Sensitive Information Exposure
Fixed in
Fixed in 7.0.1
CVSS
4.9 (medium)
Published
2023-09-11
Title
WooCommerce < 8.1.1 - Shop Manager+ User Metadata Disclosure
Fixed in
Fixed in 8.1.1
CVSS
4.9 (medium)
Published
2022-06-20
Title
WooCommerce < 6.6.0 - Admin+ Stored HTML Injection
Fixed in
Fixed in 6.6.0
CVSS
3.0 (low)
Published
2022-03-10
Title
WooCommerce < 6.3.1 - Orders Marked as Paid (via PayPal Standard Gateway)
Fixed in
Fixed in 6.3.1
CVSS
3.7 (low)
Published
2022-02-23
Title
WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion
Fixed in
Fixed in 6.2.1
CVSS
4.3 (medium)
Published
2022-02-23
Title
WooCommerce < 6.2.1 - Path Traversal via Importers
Fixed in
Fixed in 6.2.1
CVSS
5.5 (medium)
Published
2021-09-22
Title
WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Analytics Report Leaks
Fixed in
Fixed in 5.7.0
CVSS
5.3 (medium)
Published
2021-07-15
Title
Woocommerce 3.3 to 5.5 - Authenticated Blind SQL Injection
Fixed in
Fixed in 5.5.1
CVSS
7.2 (high)
Published
2021-04-21
Title
Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 5.2.0
CVSS
4.4 (medium)
Published
2020-12-28
Title
WooCommerce < 4.7.0 - Arbitrary Order Status Disclosure via IDOR
Fixed in
Fixed in 4.7.0
CVSS
5.3 (medium)
Published
2020-11-06
Title
WooCommerce < 4.6.2 - Guest Account Creation
Fixed in
Fixed in 4.6.2
CVSS
6.3 (medium)
Published
2020-06-23
Title
WooCommerce < 4.2.1 - Potential Cross-Site Scripting (XSS) via SelectWoo
Fixed in
Fixed in 4.2.1
CVSS
5.1 (medium)
Published
2020-05-12
Title
WooCommerce < 4.1.0 - Unescaped Metadata when Duplicating Products
Fixed in
Fixed in 4.1.0
CVSS
3.8 (low)
Published
2019-07-07
Title
WooCommerce <= 3.6.4 - Cross-Site Request Forgery (CSRF) & File Type Check
Fixed in
Fixed in 3.6.5
CVSS
n/a
Published
2019-02-20
Title
WooCommerce <= 3.5.4 - Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.5.5
CVSS
6.1 (medium)
Published
2018-12-21
Title
WooCommerce <= 3.5.0 - Authenticated Stored XSS
Fixed in
Fixed in 3.5.1
CVSS
n/a
Published
2018-12-10
Title
WooCommerce <= 3.4.5 - Authenticated Stored XSS
Fixed in
Fixed in 3.4.6
CVSS
n/a
Published
2018-12-10
Title
WooCommerce <= 3.4.5 - Authenticated Phar Deserialization
Fixed in
Fixed in 3.4.6
CVSS
n/a
Published
2018-10-11
Title
WooCommerce <= 3.4.5 - Authenticated Object Injection
Fixed in
Fixed in 3.4.6
CVSS
n/a
Published
2018-10-11
Title
WooCommerce <= 3.4.5 - Authenticated File Deletion to Privilege Escalation
Fixed in
Fixed in 3.4.6
CVSS
8.1 (high)
Published
2018-08-29
Title
WooCommerce <= 3.4.4 - Potential Object Injection
Fixed in
Fixed in 3.4.5
CVSS
n/a
Published
2017-11-16
Title
WooCommerce <= 3.2.3 - Authenticated PHP Object Injection
Fixed in
Fixed in 3.2.4
CVSS
8.8 (high)
Published
2016-12-07
Title
WooCommerce <= 2.6.8 - Authenticated Tax-Rate CSV XSS
Fixed in
Fixed in 2.6.9
CVSS
4.8 (medium)
Published
2016-09-09
Title
WooCommerce <= 2.6.3 - Stored Cross Site Scripting (XSS) via REST API
Fixed in
Fixed in 2.6.4
CVSS
n/a
Published
2016-07-19
Title
WooCommerce <= 2.6.2 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.6.3
CVSS
n/a
Published
2015-11-17
Title
WooCommerce <= 2.4.8 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.4.9
CVSS
n/a
Published
2015-06-10
Title
WooCommerce 2.0.20-2.3.10 - Object Injection / XXE
Fixed in
Fixed in 2.3.11
CVSS
n/a
Published
2015-03-13
Title
WooCommerce 2.3 - 2.3.5 - SQL Injection
Fixed in
Fixed in 2.3.6
CVSS
6.1 (medium)
Published
2015-02-22
Title
WooCommerce <= 2.2.10 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.2.11
CVSS
n/a
Published
2014-09-21
Title
WooCommerce < 2.2.3 - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.2.3
CVSS
n/a
Published
2014-09-17
Title
WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.2.3
CVSS
n/a
Published
2014-08-01
Title
WooCommerce 2.0.12 - index.php calc_shipping_state Parameter XSS
Fixed in
Fixed in 2.0.13
CVSS
n/a
Published
2014-08-01
Title
WooCommerce 2.0.17 - hide-wc-extensions-message Parameter Reflected XSS
Fixed in
Fixed in 2.0.17
CVSS
n/a