WooCommerce vulnerabilities

CVEs per yearBy the year they were published

1. 20212
2. 202333
3. 202410
4. 20266

Newest CVEs

• CVE-2025-14073

  WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure

  woocommerce · WooCommerce PayPal Payments

  Medium5.3
• CVE-2022-50972

  WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php

  WooCommerce · WooCommerce

  Critical9.3
• CVE-2026-2381

  WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter

  woocommerce · WooCommerce Stripe Payment Gateway

  Medium6.5
• CVE-2026-9284

  WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure

  woocommerce · WooCommerce PayPal Payments

  High8.2
• CVE-2026-1710

  WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax

  woocommerce · WooPayments: Integrated WooCommerce Payments

  Medium6.5
• CVE-2025-13457

  WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id

  woocommerce · WooCommerce Square

  High7.5
• CVE-2024-10486

  Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File

  woocommerce · Google for WooCommerce

  Medium5.3
• CVE-2020-36841

  WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation

  WooCommerce · WooCommerce Smart Coupons

  Medium5.3
• CVE-2017-20193

  Product Vendors <= 2.0.35 - Reflected Cross Site Scripting

  WooCommerce · Product Vendors

  Medium4.7
• CVE-2023-35049

  WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability

  WooCommerce · WooCommerce Stripe Payment Gateway

  High7.5