Skip to content
OpenAdvisories

Vendor

woocommerce

51 known vulnerabilities.

Products

WooCommerce Stripe Payment Gateway 5 AutomateWoo 5 Product Vendors 3 Shipping Multiple Addresses 3 woocommerce 3 WooCommerce PayPal Payments 3 WooCommerce Follow-Up Emails (AutomateWoo) 2 Product Add-Ons 2 WooCommerce Square 2 WooCommerce Brands 2 WooCommerce Pre-Orders 2 WooCommerce Box Office 2 WooCommerce Bookings 2 Woo Subscriptions 1 WooCommerce Smart Coupons 1 WooCommerce One Page Checkout 1 Bulk Stock Management 1 WooCommerce Product Vendors 1 Google for WooCommerce 1 Canada Post Shipping Method 1 Product Recommendations 1 Returns and Warranty Requests 1 WooCommerce Order Barcodes 1 GoCardless 1 Composite Products 1 WooCommerce Shipping Per Product 1 WooPayments: Integrated WooCommerce Payments 1 woocommerce-gutenberg-products-block 1
All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • High 8.2
    CVE-2026-9284

    WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure

    The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints in all versions up to, and inc…

    woocommerce WooCommerce PayPal Payments Web / CMS
  • High 7.5
    CVE-2025-13457

    WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id

    The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_id function due to missing validation on a user controlled key. This makes it possible for unauthent…

    woocommerce WooCommerce Square Web / CMS
  • High 7.5
    CVE-2023-35049

    WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.4.0.

    woocommerce WooCommerce Stripe Payment Gateway Web / CMS
  • High 7.6
    CVE-2023-35881

    WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout allows PHP Local File Inclusion.This issue affects WooCommerce One Page Checkout: from n/a through 2.3.0.

    woocommerce WooCommerce One Page Checkout Web / CMS
  • High 7.5
    CVE-2023-51502

    WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)

    Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1.

    woocommerce WooCommerce Stripe Payment Gateway Web / CMS
  • High 8.2
    CVE-2023-32795

    WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.

    woocommerce Product Add-Ons
  • High 7.6
    CVE-2023-32743

    WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.1.

    woocommerce AutomateWoo
  • High 8.5
    CVE-2023-33330

    WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.50.

    woocommerce AutomateWoo
  • High 7.5
    CVE-2023-35914

    WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)

    Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.

    woocommerce Woo Subscriptions
  • High 8.1
    CVE-2023-35876

    WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)

    Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.

    woocommerce WooCommerce Square Web / CMS
  • High 8.2
    CVE-2023-37871

    WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)

    Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.

    woocommerce GoCardless
  • High 8.5
    CVE-2023-33331

    WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.76.

    woocommerce Product Vendors
  • High 7.6
    CVE-2023-35879

    WordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78.

    woocommerce Product Vendors
  • High 7.1
    CVE-2023-33317

    WordPress WooCommerce Warranty Requests Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Returns and Warranty Requests plugin <= 2.1.6 versions.

    woocommerce Returns and Warranty Requests
  • High 7.1
    CVE-2023-32802

    WordPress WooCommerce Pre-Orders Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 1.9.0 versions.

    woocommerce WooCommerce Pre-Orders Web / CMS
  • High 7.1
    CVE-2023-32801

    WordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Composite Products plugin <= 8.7.5 versions.

    woocommerce Composite Products
  • High 7.1
    CVE-2023-37873

    WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.

    woocommerce Shipping Multiple Addresses
  • High 7.1
    CVE-2023-35918

    WordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Bulk Stock Management plugin <= 2.2.33 versions.

    woocommerce Bulk Stock Management
  • High 7.5
    CVE-2023-34000

    WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)

    Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin <= 7.4.0 versions.

    woocommerce WooCommerce Stripe Payment Gateway Web / CMS
  • High 7.1
    CVE-2023-33332

    WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.

    woocommerce WooCommerce Product Vendors Web / CMS
  • High 7.1
    CVE-2023-33319

    WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.

    woocommerce WooCommerce Follow-Up Emails (AutomateWoo) Web / CMS
  • High 7.5
    CVE-2021-32789 Public exploit Scanner template EPSS 17%

    Arbitrary SQL (SQL injection) possible via the Store API component.

    woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a care…

    woocommerce woocommerce-gutenberg-products-block Web / CMS