| CVE-2024-52379 | WordPress kineticPay for WooCommerce plugin <= 2.0.8 - Arbitrary File Upload vulnerability | faizalbahasan | kineticPay for WooCommerce | Critical | 10.0 | 2024-11-14 17:40:46 | Deep Dive |
| CVE-2024-9186 | Automation By Autonami < 3.3.0 - Unauthenticated SQLi | Unknown | Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit | - | - | 2024-11-14 06:00:11 | Deep Dive |
| CVE-2024-10820 | WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload | Unknown | WooCommerce Upload Files | Critical | 9.8 | 2024-11-13 03:20:08 | Deep Dive |
| CVE-2024-10828 | Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details | algolplus | Advanced Order Export For WooCommerce | High | 8.1 | 2024-11-13 03:20:07 | Deep Dive |
| CVE-2024-10882 | Product Delivery Date for WooCommerce - Lite <= 2.8.0 - Reflected Cross-Site Scripting | tychesoftwares | Product Delivery Date for WooCommerce – Lite | Medium | 6.1 | 2024-11-13 02:33:15 | Deep Dive |
| CVE-2024-10853 | Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order Deletion | northmule | Buy one click WooCommerce | Medium | 4.3 | 2024-11-13 02:02:35 | Deep Dive |
| CVE-2024-10854 | Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import | northmule | Buy one click WooCommerce | Medium | 4.3 | 2024-11-13 02:02:35 | Deep Dive |
| CVE-2024-10852 | Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Export | northmule | Buy one click WooCommerce | Medium | 4.3 | 2024-11-13 02:02:29 | Deep Dive |
| CVE-2024-51693 | WordPress Search order by product SKU for WooCommerce plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerability | labdav | Search order by product SKU for WooCommerce | High | 7.1 | 2024-11-09 12:46:39 | Deep Dive |
| CVE-2024-10837 | SysBasics Customize My Account for WooCommerce <= 2.7.29 - Reflected Cross-Site Scripting via tab Parameter | phppoet | SysBasics Customize My Account for WooCommerce | Medium | 6.1 | 2024-11-09 12:30:21 | Deep Dive |
| CVE-2024-10640 | The FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution | realmag777 | FOX – Currency Switcher Professional for WooCommerce | High | 7.3 | 2024-11-09 11:19:44 | Deep Dive |
| CVE-2024-51784 | WordPress FriendStore for WooCommerce plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability | VietFriend team | FriendStore for WooCommerce | High | 7.1 | 2024-11-09 08:28:59 | Deep Dive |
| CVE-2024-10627 | WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload | vanquish | WooCommerce Support Ticket System | Critical | 9.8 | 2024-11-09 03:30:47 | Deep Dive |
| CVE-2024-10625 | WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion | vanquish | WooCommerce Support Ticket System | Critical | 9.8 | 2024-11-09 03:18:15 | Deep Dive |
| CVE-2024-10626 | WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion | vanquish | WooCommerce Support Ticket System | High | 8.8 | 2024-11-09 03:18:15 | Deep Dive |
| CVE-2024-10187 | myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode | saadiqbal | Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | Medium | 6.4 | 2024-11-08 09:29:34 | Deep Dive |
| CVE-2024-10168 | Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode | realmag777 | Active Products Tables for WooCommerce. Use constructor to create tables | Medium | 6.4 | 2024-11-06 11:32:02 | Deep Dive |
| CVE-2024-10535 | Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion | nitramix | Video Gallery for WooCommerce | Medium | 5.3 | 2024-11-06 06:43:30 | Deep Dive |
| CVE-2024-9178 | XT Floating Cart for WooCommerce <= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload | xplodedthemes | XT Floating Cart for WooCommerce | Medium | 6.4 | 2024-11-05 11:00:49 | Deep Dive |
| CVE-2024-10114 | Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider | WPWeb | WooCommerce - Social Login | High | 8.1 | 2024-11-05 08:31:37 | Deep Dive |