VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

WooCommerce security & vulnerabilities

woocommerce— active installsLast vulnerability Oct 8, 2026

No known unpatched vulnerabilities in the latest version

All 47 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
47Known vulnerabilities
  • Critical0
  • High11
  • Medium35
  • Low1
Vulnerabilities per year
2013: 2 vulnerabilities2132014: 2 vulnerabilities2142015: 4 vulnerabilities4152016: 3 vulnerabilities3162017: 1 vulnerability1172018: 3 vulnerabilities3182019: 3 vulnerabilities3192020: 4 vulnerabilities4202021: 2 vulnerabilities2212022: 5 vulnerabilities5222023: 3 vulnerabilities3232024: 7 vulnerabilities7242025: 4 vulnerabilities4252026: 4 vulnerabilities426

All WooCommerce vulnerabilities

WooCommerce vulnerabilities
SeverityVulnerabilityCVEPublished
Medium4.711.1.2 - Authenticated (Shop Manager+) Privilege Escalation
9.8.0 – 11.1.2Update to 11.2.0
CVE-2026-106608
High7.5Unauthenticated Denial of Service
<11.1.0Update to 11.1.0
CVE-2026-48888
Medium4.9Authenticated (Shop Manager+) SQL Injection
≤10.9.4Update to 11.0
CVE-2026-57777
Medium4.3Cross-Site Request Forgery
<10.5.3Update to 10.5.3
CVE-2026-3589
Medium4.3Authenticated (Subscriber+) Information Exposure
≤10.3.6Update to 10.0.5 or 10.1.3 or 10.2.3 or 10.3.7 or 8.1.3 or 8.2.4 or 8.3.3 or 8.4.2 or 8.5.4 or 8.6.3 or 8.7.2 or 8.8.6 or 8.9.4 or 9.0.3 or 9.1.5 or 9.2.4 or 9.3.5 or 9.4.4 or 9.5.3 or 9.6.3 or 9.7.2 or 9.8.6 or 9.9.6
CVE-2025-15033
Medium4.4Authenticated (Shop manager+) Stored Cross-Site Scripting
≤10.0.2Update to 10.0.3
CVE-2025-49042
Medium6.1PostMessage-Based Cross-Site Scripting
≤9.4.2Update to 9.3.4 or 9.4.3
CVE-2025-5062
Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting
≤9.7.0Update to 9.7.1
CVE-2025-26762
Medium5.3Unauthenticated HTML Injection
≤9.0.2Update to 9.1.0
CVE-2024-9944
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤9.1.2Update to 9.1.3
CVE-2024-39666
Low2.7Authenticated (Shop Manager+) Content Injection
≤8.9.2Update to 9.0.0
CVE-2024-35777
Medium6.18.9.2 - Reflected Cross-Site Scripting via Order Attribution
≤8.9.2Update to 8.8.5 or 8.9.3
CVE-2024-37297
Medium4.3Cross-Site Request Forgery
≤8.5.2Update to 8.6.0
CVE-2024-22155
Medium6.1Reflected Cross-Site Scripting
<8.4.0Update to 8.4.0
—
Medium4.3Cross-Site Request Forgery
≤8.2.2Update to 8.3.0
CVE-2023-52222
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute
≤8.1.1Update to 8.2.0
CVE-2023-47777
Medium5.3Sensitive Information Exposure
≤7.8.2Update to 7.9.0
CVE-2023-7320
Medium4.9Authenticated(Shop Manager+) Sensitive Information Exposure
≤7.0.0Update to 7.0.1
—
Medium5.5Authenticated (Admin+) HTML Injection
<6.6.0Update to 6.6.0
CVE-2022-2099
Medium6.5Information Disclosure
<5.6.1Update to 4.0.3 or 4.1.3 or 4.2.4 or 4.3.5 or 4.4.3 or 4.5.4 or 4.6.4 or 4.7.3 or 4.8.2 or 4.9.4 or 5.0.2 or 5.1.2 or 5.2.4 or 5.3.2 or 5.4.3 or 5.5.3 or 5.6.1 or 5.7.0
—
Medium4.3Unauthorized Order Status Change
<6.3.1Update to 3.5.10 or 3.6.7 or 3.7.3 or 3.8.3 or 3.9.5 or 4.0.4 or 4.1.4 or 4.2.5 or 4.3.6 or 4.4.4 or 4.5.5 or 4.6.5 or 4.7.4 or 4.8.3 or 4.9.5 or 5.0.3 or 5.1.3 or 5.2.5 or 5.3.3 or 5.4.4 or 5.5.4 or 5.6.2 or 5.7.2 or 5.8.1 or 5.9.1 or 6.0.1 or 6.1.2 or 6.2.2 or 6.3.1
—
Medium5.4Incorrect Authorization Checks on REST API Endpoints
≤6.2.0Update to 6.2.1
CVE-2022-0775
High7.2Path Traversal via Tax Importer
≤6.2.0Update to 6.2.1
—
High8.8Authenticated Blind SQL Injection
≤5.5Update to 3.3.6 or 3.4.8 or 3.5.9 or 3.6.6 or 3.7.2 or 3.8.2 or 3.9.4 or 4.0.2 or 4.1.2 or 4.2.3 or 4.3.4 or 4.4.2 or 4.5.3 or 4.6.3 or 4.7.2 or 4.8.1 or 4.9.3 or 5.0.1 or 5.1.1 or 5.2.3 or 5.3.1 or 5.4.2 or 5.5.1 or 5.5.2
CVE-2021-32790
Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
<5.2.0Update to 5.2.0
CVE-2021-24323
Medium6.5Settings Bypass leading to Account Creation
<4.6.2Update to 4.6.2
—
Medium6.1Reflected Cross-Site Scripting
<4.2.1Update to 4.2.1
—
High8.8Unauthorized Post Meta Creation/Modification
<4.1.0Update to 4.1.0
—
Medium5.3Insecure Direct Object Reference via order_id Parameter
<4.7.0Update to 4.7.0
CVE-2020-29156
High7.2Missing File Type Validation
≤3.6.4Update to 3.6.5
—
High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
<3.6.5Update to 3.6.5
—
Medium6.1Stored Cross-Site Scripting
<3.5.5Update to 3.5.5
CVE-2019-9168
Medium5.5Authenticated Stored Cross-Site Scripting
≤3.5.1Update to 3.5.2
—
High7.2WooCommerce File Deletion
<3.4.6Update to 3.4.6
CVE-2018-20714
Medium6.6Authenticated PHP Object Injection
<3.4.5Update to 3.4.5
—
High8.8Authenticated PHP Object Injection
<3.2.4Update to 3.2.4
CVE-2017-18356
Medium5.5Authenticated Stored Cross-Site Scripting
<2.6.9Update to 2.6.9
CVE-2016-10112
Medium6.4Stored Cross-Site Scripting via REST-API
<2.6.4Update to 2.6.4
—
Medium6.4Stored Cross-Site Scripting
<2.6.3Update to 2.6.3
—
Medium5.5Cross-site Scripting
<2.4.9Update to 2.4.9
—
High7.5PHP Object Injection
≤2.3.10Update to 2.3.11
—
High7.2Stored Cross-Site Scripting
<2.3.6Update to 2.3.6
CVE-2015-2329
Medium6.1Cross-Site Scripting
<2.2.11Update to 2.2.11
CVE-2015-2069
Medium6.1Reflected Cross-Site Scripting
<2.2.3Update to 2.2.3
—
High7.3Cross-Site Scripting via range Parameter
<2.2.3Update to 2.2.3
CVE-2014-6313
Medium6.1Cross-Site Scripting
≤2.0.17Update to 2.0.18
—
Medium6.1Self-Reflected Cross-Site Scripting
≤2.0.12Update to 2.0.13
—

WooCommerce: common questions

Does WooCommerce have known vulnerabilities?

Yes. VulnCrest Radar lists 47 known vulnerabilities in WooCommerce: 11 high, 35 medium, 1 low. None are known to affect version null.

How do I check which version of WooCommerce I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent WooCommerce vulnerability?

CVE-2026-106608, published Oct 8, 2026: WooCommerce 9.8.0 - 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation. Severity: Medium (CVSS 4.7).

Is any WooCommerce vulnerability listed in CISA KEV?

No. None of the known WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?