Automattic WooCommerce vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20231
3. 20245
4. 20255
5. 20264

Newest CVEs

• CVE-2026-106608

  WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability

  Automattic · WooCommerce

  High7.2
• CVE-2026-48888

  WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability

  Automattic · WooCommerce

  High7.5
• CVE-2026-57777

  WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

  Automattic · WooCommerce

  High7.6
• CVE-2026-3589

  WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

  Automattic · WooCommerce

  High7.5
• CVE-2025-15033

  WooCommerce - Subscriber/Customer+ Order Data Disclosure

  Automattic · WooCommerce

  Medium6.5
• CVE-2023-7320

  WooCommerce <= 7.8.2 - Sensitive Information Exposure

  automattic · WooCommerce

  Medium5.3
• CVE-2025-49042

  WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability

  Automattic · WooCommerce

  Medium5.9
• CVE-2025-5062

  WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting

  automattic · WooCommerce

  Medium6.1
• CVE-2025-26762

  WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability

  Automattic · WooCommerce

  Medium5.9
• CVE-2024-9944

  WooCommerce <= 9.0.2 - Unauthenticated HTML Injection

  automattic · WooCommerce

  Medium5.3