Skip to content
OpenAdvisories

Vendor

woocommerce

51 known vulnerabilities.

Products

WooCommerce Stripe Payment Gateway 5 AutomateWoo 5 Product Vendors 3 Shipping Multiple Addresses 3 woocommerce 3 WooCommerce PayPal Payments 3 WooCommerce Follow-Up Emails (AutomateWoo) 2 Product Add-Ons 2 WooCommerce Square 2 WooCommerce Brands 2 WooCommerce Pre-Orders 2 WooCommerce Box Office 2 WooCommerce Bookings 2 Woo Subscriptions 1 WooCommerce Smart Coupons 1 WooCommerce One Page Checkout 1 Bulk Stock Management 1 WooCommerce Product Vendors 1 Google for WooCommerce 1 Canada Post Shipping Method 1 Product Recommendations 1 Returns and Warranty Requests 1 WooCommerce Order Barcodes 1 GoCardless 1 Composite Products 1 WooCommerce Shipping Per Product 1 WooPayments: Integrated WooCommerce Payments 1 woocommerce-gutenberg-products-block 1
All Critical High Medium Low Exploited only Public exploit

51 results · Feed

  • Medium 5.4
    CVE-2023-36513

    WordPress AutomateWoo Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions.

    woocommerce AutomateWoo
  • Medium 4.3
    CVE-2023-36511

    WordPress WooCommerce Order Barcodes Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Order Barcodes plugin <= 1.6.4 versions.

    woocommerce WooCommerce Order Barcodes Web / CMS
  • Medium 5.4
    CVE-2023-35880

    WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.49 versions.

    woocommerce WooCommerce Brands Web / CMS
  • Medium 4.3
    CVE-2023-35917

    WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions.

    woocommerce WooCommerce PayPal Payments Web / CMS
  • High 7.1
    CVE-2023-35918

    WordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Bulk Stock Management plugin <= 2.2.33 versions.

    woocommerce Bulk Stock Management
  • High 7.5
    CVE-2023-34000

    WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)

    Unauth. IDOR vulnerability leading to PII Disclosure in WooCommerce Stripe Payment Gateway plugin <= 7.4.0 versions.

    woocommerce WooCommerce Stripe Payment Gateway Web / CMS
  • High 7.1
    CVE-2023-33332

    WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.

    woocommerce WooCommerce Product Vendors Web / CMS
  • High 7.1
    CVE-2023-33319

    WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.

    woocommerce WooCommerce Follow-Up Emails (AutomateWoo) Web / CMS
  • Medium 5.4
    CVE-2023-33316

    WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.

    woocommerce WooCommerce Follow-Up Emails (AutomateWoo) Web / CMS
  • Medium 4.9
    CVE-2021-32790

    Blind SQL Injection possible via Authenticated Web-hook Search API Endpoint

    Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCo…

    woocommerce woocommerce Web / CMS
  • High 7.5
    CVE-2021-32789 Public exploit Scanner template EPSS 17%

    Arbitrary SQL (SQL injection) possible via the Store API component.

    woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a care…

    woocommerce woocommerce-gutenberg-products-block Web / CMS