HomeWordPress vulnerabilitiesWooCommerce
WooCommerce vulnerabilities
WooCommerce has 17 known vulnerabilities in this database. The most recent published record is dated 6 Mar 2026.
- Known vulnerabilities
- 17
- Active installs
- 7m+
- Latest version
- 11.1.2
- Last updated
- 22 Sep 2026
- Most recent
- 6 Mar 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Cross-site request forgery (CSRF) CVE-2026-3589 | High 7.5 | Not yet published | Check for an update | 6 Mar 2026 |
| Sensitive data exposure CVE-2023-7320 | Medium 5.3 | Up to 7.8.2 | Fixed in a later version (latest 11.1.2) | 29 Oct 2025 |
| Cross-site scripting (XSS) CVE-2025-5062 | Medium 6.1 | Before 9.4.3 | Fixed in 9.4.3 | 22 May 2025 |
| Content injection CVE-2024-9944 | Medium 5.3 | Before 9.1.0 | Fixed in 9.1.0 | 15 Oct 2024 |
| Cross-site scripting (XSS) CVE-2024-37297 | Medium 5.4 | Before 8.9.3 | Fixed in 8.9.3 | 12 Jun 2024 |
| Security weakness CVE-2024-1310 | Medium 4.9 | Before 8.6.0 | Fixed in 8.6.0 | 15 Apr 2024 |
| Broken access control CVE-2022-0775 | Medium 4.3 | Before 6.2.1 | Fixed in 6.2.1 | 16 Jan 2024 |
| Content injection CVE-2022-2099 | Medium 4.8 | Before 6.6.0 | Fixed in 6.6.0 | 17 Jul 2022 |
| SQL injection CVE-2021-32790 | Medium 4.9 | Before 5.5.1 | Fixed in 5.5.1 | 26 Jul 2021 |
| Broken access control CVE-2020-29156 | Medium 5.3 | Before 4.7.0 | Fixed in 4.7.0 | 27 Dec 2020 |
| PHP object injection CVE-2017-18356 | High 8.8 | Before 3.2.4 | Fixed in 3.2.4 | 15 Jan 2019 |
| Path traversal CVE-2018-20714 | High 8.1 | Before 3.4.6 | Fixed in 3.4.6 | 15 Jan 2019 |
| Cross-site scripting (XSS) CVE-2015-2329 | Medium 6.1 | Before 2.3.6 | Fixed in 2.3.6 | 8 Feb 2018 |
| Path traversal CVE-2017-17058 | High 7.5 | Up to 3.2.6 | Fixed in a later version (latest 11.1.2) | 29 Nov 2017 |
| Cross-site scripting (XSS) CVE-2016-10112 | Medium 4.8 | Up to 2.6.8 | Fixed in a later version (latest 11.1.2) | 4 Jan 2017 |
| Cross-site scripting (XSS) CVE-2015-2069 | Not scored | Up to 2.2.10 | Fixed in a later version (latest 11.1.2) | 24 Feb 2015 |
| Cross-site scripting (XSS) CVE-2014-6313 | Not scored | Up to 2.2.2 | Fixed in a later version (latest 11.1.2) | 14 Oct 2014 |
Read the published descriptions
- CVE-2026-3589, 6 Mar 2026
- The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example. CVE record
- CVE-2023-7320, 29 Oct 2025
- The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on the Store API's REST endpoints allowing direct external access from any origin. This can allow unauthenticated attackers to extract sensitive user information including PII(Personal Identifiable Information). CVE record
- CVE-2025-5062, 22 May 2025
- The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and including, 9.4.2 due to insufficient input sanitization and output escaping on PostMessage data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE record
- CVE-2024-9944, 15 Oct 2024
- The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views order form submissions. CVE record
- CVE-2024-37297, 12 Jun 2024
- WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the `Sourcebuster.js` library and then inserted without proper sanitization to the classic checkout and registration forms. Versions 8.8.5 and 8.9.3 contain a patch for the issue. As a workaround, one may disable the Order Attribution feature. CVE record
- CVE-2024-1310, 15 Apr 2024
- The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products) CVE record
- CVE-2022-0775, 16 Jan 2024
- The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment CVE record
- CVE-2022-2099, 17 Jul 2022
- The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles CVE record
- CVE-2021-32790, 26 Jul 2021
- Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading. CVE record
- CVE-2020-29156, 27 Dec 2020
- The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action. CVE record
- CVE-2017-18356, 15 Jan 2019
- In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection involving the includes/shortcodes/class-wc-shortcode-products.php WC_Shortcode_Products::get_products() use of cached queries within shortcodes. CVE record
- CVE-2018-20714, 15 Jan 2019
- The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of woocommerce.php, which leads to certain privilege checks not being in place, and therefore a shop manager can escalate privileges to admin. CVE record
- CVE-2015-2329, 8 Feb 2018
- Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order. CVE record
- CVE-2017-17058, 29 Nov 2017
- The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. NOTE: a software maintainer indicates that Directory Traversal is not possible because all of the template files have "if (!defined('ABSPATH')) {exit;}" code CVE record
- CVE-2016-10112, 4 Jan 2017
- Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by providing crafted tax-rate table values in CSV format. CVE record
- CVE-2015-2069, 24 Feb 2015
- Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php. CVE record
- CVE-2014-6313, 14 Oct 2014
- Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php. CVE record
What to do if you run WooCommerce
If you run WooCommerce, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new WooCommerce vulnerabilities
Free. We email you when a new vulnerability is published for WooCommerce, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.