WooCommerce

Software Type	Plugin
Software Slug	woocommerce (view on wordpress.org)
Software Status	Active
Software Author	automattic
Software Website	woocommerce.com
Software Downloads	461,261,799
Software Active Installs	7,000,000
Software Record Last Updated	September 8, 2026

Showing 1-20 of 44 Vulnerabilities

Submit a Vulnerability

WooCommerce <= 8.9.2 - Authenticated (Shop Manager+) Content Injection

2.7

CVE-2024-35777

Jun 27, 2024

Researcher: SavPhill (Savphill)

WooCommerce < 10.5.3 - Cross-Site Request Forgery

4.3

CVE-2026-3589

Mar 10, 2026

Researcher: oolongeya

WooCommerce <= 10.4.2 - Authenticated (Subscriber+) Information Exposure

4.3

CVE-2025-15033

Dec 22, 2025

Researchers: Peter Stöckli, Man Yue Mo

WooCommerce <= 8.5.2 - Cross-Site Request Forgery

4.3

CVE-2024-22155

Apr 5, 2024

Researcher: Dhabaleshwar Das

WooCommerce <= 8.2.2 - Cross-Site Request Forgery

4.3

CVE-2023-52222

Jan 5, 2024

Researcher: Rafie Muhammad

WooCommerce < 6.3.1 - Unauthorized Order Status Change

4.3

CVE ID Unknown

Mar 10, 2022

Researchers:

WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting

4.4

CVE-2025-49042

Oct 29, 2025

Researcher: SavPhill (Savphill)

WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting

4.4

CVE-2025-26762

Mar 12, 2025

Researcher: SavPhill (Savphill)

WooCommerce <= 9.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVE-2024-39666

Aug 16, 2024

Researcher: stealthcopter

WooCommerce <= 5.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.8

CVE-2021-24323

Apr 21, 2021

Researcher: R3N0

WooCommerce <= 7.0.0 - Authenticated(Shop Manager+) Sensitive Information Exposure

4.9

CVE ID Unknown

Sep 11, 2023

Researcher: David Anderson

WooCommerce <= 9.0.2 - Unauthenticated HTML Injection

5.3

CVE-2024-9944

Oct 14, 2024

Researcher: drop

WooCommerce <= 7.8.2 - Sensitive Information Exposure

5.3

CVE-2023-7320

Sep 11, 2023

Researcher: osama-hamad

WooCommerce < 4.7.0 - Insecure Direct Object Reference via order_id Parameter

5.3

CVE-2020-29156

Jan 21, 2020

Researcher: Ko-kn3t

WooCommerce <= 6.2.0 - Incorrect Authorization Checks on REST API Endpoints

5.4

CVE-2022-0775

Feb 22, 2022

Researcher: Krzysztof Zając

WooCommerce <= 6.5.1 - Authenticated (Admin+) HTML Injection

5.5

CVE-2022-2099

Jun 20, 2022

Researcher: Taurus Omar

WooCommerce <= 3.5.1 - Authenticated Stored Cross-Site Scripting

5.5

CVE ID Unknown

Nov 29, 2018

Researcher: Karim El Ouerghemmi

WooCommerce <= 2.6.8 - Authenticated Stored Cross-Site Scripting

5.5

CVE-2016-10112

Dec 7, 2016

Researchers:

WooCommerce < 2.4.9 - Cross-site Scripting

5.5

CVE ID Unknown

Nov 17, 2015

Researcher: Zhouyuan Yang

WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting

6.1

CVE-2025-5062

May 21, 2025

Researcher: Antonio Rocco Spataro

Title	Status	CVE ID	CVSS	Researchers	Date
WooCommerce <= 8.9.2 - Authenticated (Shop Manager+) Content Injection	Patched	CVE-2024-35777	2.7	SavPhill (Savphill)	June 27, 2024
WooCommerce < 10.5.3 - Cross-Site Request Forgery	Patched	CVE-2026-3589	4.3	oolongeya	March 10, 2026
WooCommerce <= 10.4.2 - Authenticated (Subscriber+) Information Exposure	Patched	CVE-2025-15033	4.3	Peter Stöckli, Man Yue Mo	December 22, 2025
WooCommerce <= 8.5.2 - Cross-Site Request Forgery	Patched	CVE-2024-22155	4.3	Dhabaleshwar Das	April 5, 2024
WooCommerce <= 8.2.2 - Cross-Site Request Forgery	Patched	CVE-2023-52222	4.3	Rafie Muhammad	January 5, 2024
WooCommerce < 6.3.1 - Unauthorized Order Status Change	Patched		4.3		March 10, 2022
WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting	Patched	CVE-2025-49042	4.4	SavPhill (Savphill)	October 29, 2025
WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting	Patched	CVE-2025-26762	4.4	SavPhill (Savphill)	March 12, 2025
WooCommerce <= 9.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting	Patched	CVE-2024-39666	4.4	stealthcopter	August 16, 2024
WooCommerce <= 5.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting	Patched	CVE-2021-24323	4.8	R3N0	April 21, 2021
WooCommerce <= 7.0.0 - Authenticated(Shop Manager+) Sensitive Information Exposure	Patched		4.9	David Anderson	September 11, 2023
WooCommerce <= 9.0.2 - Unauthenticated HTML Injection	Patched	CVE-2024-9944	5.3	drop	October 14, 2024
WooCommerce <= 7.8.2 - Sensitive Information Exposure	Patched	CVE-2023-7320	5.3	osama-hamad	September 11, 2023
WooCommerce < 4.7.0 - Insecure Direct Object Reference via order_id Parameter	Patched	CVE-2020-29156	5.3	Ko-kn3t	January 21, 2020
WooCommerce <= 6.2.0 - Incorrect Authorization Checks on REST API Endpoints	Patched	CVE-2022-0775	5.4	Krzysztof Zając	February 22, 2022
WooCommerce <= 6.5.1 - Authenticated (Admin+) HTML Injection	Patched	CVE-2022-2099	5.5	Taurus Omar	June 20, 2022
WooCommerce <= 3.5.1 - Authenticated Stored Cross-Site Scripting	Patched		5.5	Karim El Ouerghemmi	November 29, 2018
WooCommerce <= 2.6.8 - Authenticated Stored Cross-Site Scripting	Patched	CVE-2016-10112	5.5		December 7, 2016
WooCommerce < 2.4.9 - Cross-site Scripting	Patched		5.5	Zhouyuan Yang	November 17, 2015
WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting	Patched	CVE-2025-5062	6.1	Antonio Rocco Spataro	May 21, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation