Advisories · Technology

Automattic WooCommerce.

Every CVE that names Automattic WooCommerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-106608 CVE record

CVSS 7.2 High

WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability
- Automattic WooCommerce
- Privilege escalation
Not analysed yet 10 Oct 2026
CVE-2026-48888 CVE record

CVSS 7.5 High

WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
- Automattic WooCommerce
- Denial of service
Not analysed yet 8 Sept 2026
CVE-2026-57777 CVE record

CVSS 7.6 High

WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability
- Automattic WooCommerce
- SQL injection
Not analysed yet 4 Sept 2026
CVE-2026-3589 CVE record

CVSS 7.5 High

WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
- Automattic WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 6 Mar 2026
CVE-2025-15033 CVE record

CVSS 6.5 Medium

WooCommerce - Subscriber/Customer+ Order Data Disclosure
- Automattic WooCommerce
- Information disclosure
Not analysed yet 22 Dec 2025
CVE-2023-7320 CVE record

CVSS 5.3 Medium

WooCommerce <= 7.8.2 - Sensitive Information Exposure
- automattic WooCommerce
- Information disclosure
Not analysed yet 29 Oct 2025
CVE-2025-49042 CVE record

CVSS 5.9 Medium

WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability
- Automattic WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 29 Oct 2025
CVE-2025-5062 CVE record

CVSS 6.1 Medium

WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting
- automattic WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 22 May 2025
CVE-2025-26762 CVE record

CVSS 5.9 Medium

WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability
- Automattic WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 27 Mar 2025
CVE-2024-9944 CVE record

CVSS 5.3 Medium

WooCommerce <= 9.0.2 - Unauthenticated HTML Injection
- automattic WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 15 Oct 2024
CVE-2024-39666 CVE record

CVSS 5.9 Medium

WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability
- Automattic WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 18 Aug 2024
CVE-2024-35777 CVE record

CVSS 3.5 Low

WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability
- Automattic WooCommerce
- Other injection
Not analysed yet 9 Jul 2024
CVE-2024-22155 CVE record

CVSS 4.3 Medium

WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability
- Automattic WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 7 Apr 2024
CVE-2023-52222 CVE record

CVSS 4.3 Medium

WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)
- Automattic WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 8 Jan 2024
CVE-2023-47777 CVE record

CVSS 6.5 Medium

WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability
- Automattic WooCommerce
- Automattic WooCommerce Blocks
- Cross-site scripting (XSS)
Not analysed yet 30 Nov 2023