Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

WooCommerce — Vulnerabilities & Security Advisories 21

All 21 CVE vulnerabilities found in WooCommerce, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the product WooCommerce, specifically focusing on Common Weakness Enumeration (CWE) weakness types and associated security tags. The collection covers historical and recent security advisories, spanning from the earliest recorded flaws to the most recently disclosed issues for this e-commerce platform. Readers can use this interface to track the vendor's advisory release patterns, understand the prevalence of specific weakness classes, and review the complete vulnerability history of the product. This resource serves as a structured reference for security professionals auditing the application’s exposure to known defects, without listing individual CVE identifiers in the introductory text.

Vendor: Automattic

CVE ID Title CVSS Severity Published
CVE-2026-48888 WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability CWE-770 7.5 High 2026-09-08
CVE-2026-57777 WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability CWE-89 7.6 High 2026-09-04
CVE-2022-50972 WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php CWE-94 9.8 Critical 2026-06-20
CVE-2026-3589 WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF 8.8 - 2026-03-06
CVE-2025-15033 WooCommerce - Subscriber/Customer+ Order Data Disclosure 4.3AI Medium AI 2025-12-22
CVE-2023-7320 WooCommerce <= 7.8.2 - Sensitive Information Exposure CWE-200 5.3 Medium 2025-10-29
CVE-2025-49042 WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability CWE-79 5.9 Medium 2025-10-29
CVE-2025-5062 WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting CWE-79 6.1 Medium 2025-05-22
CVE-2025-26762 WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability CWE-79 5.9 Medium 2025-03-27
CVE-2024-9944 WooCommerce <= 9.0.2 - Unauthenticated HTML Injection CWE-79 5.3 Medium 2024-10-15
CVE-2024-39666 WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability CWE-79 5.9 Medium 2024-08-18
CVE-2024-35777 WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability CWE-74 3.5 Low 2024-07-09
CVE-2024-37297 WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms CWE-79 5.4 Medium 2024-06-12
CVE-2024-1310 WooCommerce < 8.6 - Contributor+ Private/Draft Products Access 4.3AI Medium AI 2024-04-15
CVE-2024-22155 WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability CWE-352 4.3 Medium 2024-04-07
CVE-2022-0775 WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion 4.3 - 2024-01-16
CVE-2023-52222 WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) CWE-352 4.3 Medium 2024-01-08
CVE-2023-47777 WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2023-11-30
CVE-2022-2099 WooCommerce < 6.6.0 - Admin+ Stored HTML Injection 5.4 - 2022-07-17
CVE-2021-32790 Blind SQL Injection possible via Authenticated Web-hook Search API Endpoint CWE-89 4.9 Medium 2021-07-26
CVE-2021-24323 Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS) CWE-79 4.8 - 2021-05-17

All 21 known CVE vulnerabilities affecting WooCommerce with full Chinese analysis, references, and POCs where available.