Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,321All CVEsplus 19,140 rejected
- 471Last 24 hours2,738 in the last 7 days
- 16,929Last 30 days1,560 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 2 | 3 | 0 | 0 | 6 | 51 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 45 |
| 2024 | 0 | 3 | 7 | 0 | 0 | 10 | 45 |
| 2023 | 1 | 16 | 16 | 0 | 0 | 33 | 35 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2021 | 0 | 1 | 1 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2025-14073 | WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosurewoocommerce · WooCommerce PayPal Payments | Medium5.3 |
| CVE-2022-50972 | WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.phpWooCommerce · WooCommerce | Critical9.3 |
| CVE-2026-2381 | WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameterwoocommerce · WooCommerce Stripe Payment Gateway | Medium6.5 |
| CVE-2026-9284 | WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosurewoocommerce · WooCommerce PayPal Payments | High8.2 |
| CVE-2026-1710 | WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajaxwoocommerce · WooPayments: Integrated WooCommerce Payments | Medium6.5 |
| CVE-2025-13457 | WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_idwoocommerce · WooCommerce Square | High7.5 |
| CVE-2024-10486 | Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info Filewoocommerce · Google for WooCommerce | Medium5.3 |
| CVE-2020-36841 | WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon CreationWooCommerce · WooCommerce Smart Coupons | Medium5.3 |
| CVE-2017-20193 | Product Vendors <= 2.0.35 - Reflected Cross Site ScriptingWooCommerce · Product Vendors | Medium4.7 |
| CVE-2023-35049 | WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerabilityWooCommerce · WooCommerce Stripe Payment Gateway | High7.5 |
| CVE-2024-37297 | WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration formswoocommerce · woocommerce | Medium5.4 |
| CVE-2023-35881 | WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerabilityWooCommerce · WooCommerce One Page Checkout | High7.6 |
| CVE-2023-51499 | WordPress WooCommerce Shipping Per Product plugin <= 2.5.4 - Broken Access Control vulnerabilityWooCommerce · WooCommerce Shipping Per Product | Medium4.3 |
| CVE-2023-44999 | WordPress WooCommerce Stripe Gateway plugin <= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerabilityWooCommerce · WooCommerce Stripe Payment Gateway | Medium5.4 |
| CVE-2024-24799 | WordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerabilityWooCommerce · WooCommerce Box Office | Medium6.5 |
| CVE-2023-51502 | WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce · WooCommerce Stripe Payment Gateway | High7.5 |
| CVE-2023-32795 | WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to PHP Object InjectionWooCommerce · Product Add-Ons | High8.2 |
| CVE-2023-32799 | WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce · Shipping Multiple Addresses | Medium6.5 |
| CVE-2023-32747 | WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce · WooCommerce Bookings | Medium5.4 |
| CVE-2023-33318 | WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File UploadWooCommerce · AutomateWoo | Critical9.9 |
| CVE-2023-32743 | WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL InjectionWooCommerce · AutomateWoo | High7.6 |
| CVE-2023-33330 | WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL InjectionWooCommerce · AutomateWoo | High8.5 |
| CVE-2023-35914 | WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce · Woo Subscriptions | High7.5 |
| CVE-2023-35876 | WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce · WooCommerce Square | High8.1 |
| CVE-2023-37871 | WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce · GoCardless | High8.2 |
| CVE-2023-33331 | WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL InjectionWooCommerce · Product Vendors | High8.5 |
| CVE-2023-47789 | WordPress WooCommerce Canada Post Shipping Plugin <= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce · Canada Post Shipping Method | Medium4.3 |
| CVE-2023-47787 | WordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce · WooCommerce Bookings | Medium4.3 |
| CVE-2023-32744 | WordPress WooCommerce Product Recommendations Plugin < 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce · Product Recommendations | Medium5.4 |
| CVE-2023-32745 | WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce · AutomateWoo | Medium5.4 |
| CVE-2023-32794 | WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce · Product Add-Ons | Medium5.4 |
| CVE-2023-35879 | WordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL InjectionWooCommerce · Product Vendors | High7.6 |
| CVE-2023-34004 | WordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS)WooCommerce · WooCommerce Box Office | Medium6.5 |
| CVE-2023-33317 | WordPress WooCommerce Warranty Requests Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)WooCommerce · Returns and Warranty Requests | High7.1 |
| CVE-2023-32746 | WordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)WooCommerce · WooCommerce Brands | Medium6.5 |
| CVE-2023-32793 | WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)WooCommerce · WooCommerce Pre-Orders | Medium6.5 |
| CVE-2023-32802 | WordPress WooCommerce Pre-Orders Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)WooCommerce · WooCommerce Pre-Orders | High7.1 |
| CVE-2023-32801 | WordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS)WooCommerce · Composite Products | High7.1 |
| CVE-2023-37873 | WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Scripting (XSS)WooCommerce · Shipping Multiple Addresses | High7.1 |
| CVE-2023-36514 | WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce · Shipping Multiple Addresses | Medium6.5 |
| CVE-2023-36513 | WordPress AutomateWoo Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce · AutomateWoo | Medium5.4 |
| CVE-2023-36511 | WordPress WooCommerce Order Barcodes Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce · WooCommerce Order Barcodes | Medium4.3 |
| CVE-2023-35880 | WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce · WooCommerce Brands | Medium5.4 |
| CVE-2023-35917 | WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce · WooCommerce PayPal Payments | Medium4.3 |
| CVE-2023-35918 | WordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)WooCommerce · Bulk Stock Management | High7.1 |
| CVE-2023-34000 | WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce · WooCommerce Stripe Payment Gateway | High7.5 |
| CVE-2023-33332 | WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS)WooCommerce · WooCommerce Product Vendors | High7.1 |
| CVE-2023-33319 | WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS)WooCommerce · WooCommerce Follow-Up Emails (AutomateWoo) | High7.1 |
| CVE-2023-33316 | WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce · WooCommerce Follow-Up Emails (AutomateWoo) | Medium5.4 |
| CVE-2021-32790 | Blind SQL Injection possible via Authenticated Web-hook Search API Endpointwoocommerce · woocommerce | Medium4.9 |