Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 222

Export CSV
CVE-2025-69045

WordPress FooEvents for WooCommerce plugin <= 1.20.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FooEvents FooEvents for WooCommerce fooevents allows SQL Injection.This issue affects FooEvents for WooCommerce: from n/a through <= 1.20.4.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Fooevents Woocommerce Wordpress
Products
Fooevents For Woocommerce Woocommerce Wordpress
CVE-2025-69088

WordPress Combo Offers WooCommerce plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows DOM-Based XSS.This issue affects Combo Offers WooCommerce: from n/a through <= 4.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vidish Woocommerce Wordpress
Products
Combo Offers Woocommerce Woocommerce Wordpress
CVE-2025-49379

WordPress Custom Fields Account Registration For Woocommerce plugin <= 1.2 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in silverplugins217 Custom Fields Account Registration For Woocommerce custom-fields-account-registration-for-woocommerce allows Privilege Escalation.This issue affects Custom Fields Account Registration For Woocommerce: from n/a through <= 1.2.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Silverplugins217 Woocommerce Wordpress
Products
Custom Fields Account Registration For Woocommerce Woocommerce Wordpress
CVE-2025-60243

WordPress Selling Commander for WooCommerce plugin <= 1.2.46 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Holest Engineering Selling Commander for WooCommerce selling-commander-connector allows Privilege Escalation.This issue affects Selling Commander for WooCommerce: from n/a through <= 1.2.46.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Holest Engineering Woocommerce Wordpress
Products
Selling Commander For Woocommerce Woocommerce Wordpress
CVE-2025-13457

WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id

The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_id function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Square "ccof" (credit card on file) values and leverage this value to potentially make fraudulent charges on the target site.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Automattic Woocommerce Wordpress
Products
Woocommerce Square Woocommerce Wordpress
CVE-2025-60235

WordPress Support Ticket System for WooCommerce plugin <= 2.0.7 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Plugify Support Ticket System for WooCommerce (Premium) support-ticket-system-for-woocommerce allows Using Malicious Files.This issue affects Support Ticket System for WooCommerce (Premium): from n/a through <= 2.0.7.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Plugify Woocommerce Wordpress
Products
Helpdesk Support Ticket System For Woocommerce Woocommerce Wordpress
CVE-2025-60222

WordPress SUMO Memberships for WooCommerce plugin <= 7.8.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Privilege Escalation.This issue affects SUMO Memberships for WooCommerce: from n/a through <= 7.8.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Fantasticplugins Woocommerce Wordpress
Products
Sumo Memberships For Woocommerce Woocommerce Wordpress
CVE-2025-53297

WordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Envato Affiliates wooenvato allows Reflected XSS.This issue affects Woocommerce Envato Affiliates: from n/a through <= 1.2.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Aa-team Woocommerce Wordpress
Products
Woocommerce Envato Affiliates Woocommerce Wordpress
CVE-2025-60211

WordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Privilege Escalation.This issue affects WooCommerce Registration Fields Plugin - Custom Signup Fields: from n/a through <= 3.2.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Extendons Woocommerce Wordpress
Products
Woocommerce Registration Fields Plugin Woocommerce Wordpress
CVE-2025-60207

WordPress Custom User Registration Fields for WooCommerce plugin <= 2.1.2 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through <= 2.1.2.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Addify Woocommerce Wordpress
Products
Custom User Registration Fields For Woocommerce Woocommerce Wordpress
CVE-2025-10412

Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.55 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file'

The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'uni_cpo_upload_file' function in all versions up to, and including, 4.9.55. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Woocommerce Wordpress
Products
Woocommerce Wordpress
CVE-2025-53422

WordPress WhatsApp Chat for WordPress and WooCommerce plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeWarriors WhatsApp Chat for WordPress and WooCommerce tw-whatsapp-chat-rotator allows Reflected XSS.This issue affects WhatsApp Chat for WordPress and WooCommerce: from n/a through <= 1.2.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Themewarriors Woocommerce Wordpress
Products
Whatsapp Chat Woocommerce Wordpress
CVE-2025-49947

WordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Reflected XSS.This issue affects WooCommerce Registration Fields Plugin - Custom Signup Fields: from n/a through <= 3.2.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Extendons Woocommerce Wordpress
Products
Woocommerce Registration Fields Plugin Woocommerce Wordpress
CVE-2024-10820

WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload

The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 84.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Vanquish Woocommerce
Products
Woocommerce Upload Files Upload Files
CVE-2024-9944

WooCommerce <= 9.0.2 - Unauthenticated HTML Injection

The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views order form submissions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Woocommerce Woothemes
Products
Woocommerce Woocommerce
CVE-2022-0775

WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion

The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Woocommerce
Products
Woocommerce
CVE-2024-1747

WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS

The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vanquish Woocommerce
Products
Woocommerce Customers Manager Woocommerce Customers Manager