WordPress Plugin Vulnerabilities

WooCommerce

2022-06-20

WooCommerce < 6.6.0 - Admin+ Stored HTML Injection

Fixed in version 6.6.0

2022-03-10

WooCommerce < 6.3.1 - Orders Marked as Paid (via PayPal Standard Gateway)

Fixed in version 6.3.1

2022-02-23

WooCommerce < 6.2.1 - Path Traversal via Importers

Fixed in version 6.2.1

2022-02-23

WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion

Fixed in version 6.2.1

2021-09-22

WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Analytics Report Leaks

Fixed in version 5.7.0

2021-07-15

Woocommerce 3.3 to 5.5 - Authenticated Blind SQL Injection

Fixed in version 5.5.1

2021-04-21

Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)

Fixed in version 5.2.0

2020-12-28

WooCommerce < 4.7.0 - Arbitrary Order Status Disclosure via IDOR

Fixed in version 4.7.0

2020-11-06

WooCommerce < 4.6.2 - Guest Account Creation

Fixed in version 4.6.2

2020-06-23

WooCommerce < 4.2.1 - Potential Cross-Site Scripting (XSS) via SelectWoo

Fixed in version 4.2.1

2020-05-12

WooCommerce < 4.1.0 - Unescaped Metadata when Duplicating Products

Fixed in version 4.1.0

2019-07-07

WooCommerce <= 3.6.4 - Cross-Site Request Forgery (CSRF) & File Type Check

Fixed in version 3.6.5

2019-02-20

WooCommerce <= 3.5.4 - Stored Cross-Site Scripting (XSS)

Fixed in version 3.5.5

2018-12-21

WooCommerce <= 3.5.0 - Authenticated Stored XSS

Fixed in version 3.5.1

2018-12-10

WooCommerce <= 3.4.5 - Authenticated Phar Deserialization

Fixed in version 3.4.6

2018-12-10

WooCommerce <= 3.4.5 - Authenticated Stored XSS

Fixed in version 3.4.6

2018-10-11

WooCommerce <= 3.4.5 - Authenticated File Deletion to Privilege Escalation

Fixed in version 3.4.6

2018-10-11

WooCommerce <= 3.4.5 - Authenticated Object Injection

Fixed in version 3.4.6

2018-08-29

WooCommerce <= 3.4.4 - Potential Object Injection

Fixed in version 3.4.5

2017-11-16

WooCommerce <= 3.2.3 - Authenticated PHP Object Injection

Fixed in version 3.2.4

2016-12-07

WooCommerce <= 2.6.8 - Authenticated Tax-Rate CSV XSS

Fixed in version 2.6.9

2016-09-09

WooCommerce <= 2.6.3 - Stored Cross Site Scripting (XSS) via REST API

Fixed in version 2.6.4

2016-07-19

WooCommerce <= 2.6.2 - Authenticated Cross-Site Scripting (XSS)

Fixed in version 2.6.3

2015-11-17

WooCommerce <= 2.4.8 - Authenticated Cross-Site Scripting (XSS)

Fixed in version 2.4.9

2015-06-10

WooCommerce 2.0.20-2.3.10 - Object Injection / XXE

Fixed in version 2.3.11

2015-03-13

WooCommerce 2.3 - 2.3.5 - SQL Injection

Fixed in version 2.3.6

2015-02-22

WooCommerce <= 2.2.10 - Cross-Site Scripting (XSS)

Fixed in version 2.2.11

2014-09-21

WooCommerce <= 2.1.12 - Reflected Cross-Site Scripting (XSS)

Fixed in version 2.2.3

2014-09-17

WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting (XSS)

Fixed in version 2.2.3

2014-08-01

WooCommerce 2.0.17 - hide-wc-extensions-message Parameter Reflected XSS

Fixed in version 2.0.17

2014-08-01

WooCommerce 2.0.12 - index.php calc_shipping_state Parameter XSS

Fixed in version 2.0.13