Skip to content
Noroxi

WooCommerce records

72 published records for vendor woocommerce.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
68.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

72 records
  • CVE-2021-24212
    41Plan

    WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE

    CriticalCVSS 9.8Proof of conceptEPSS 7%

    woocommerce · help scoutApr 5, 2021

  • CVE-2023-35049
    39Monitor

    WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    woocommerce · stripe payment gatewayJun 19, 2024

  • CVE-2023-51494
    39Monitor

    WordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    woocommerce · product vendorsJun 9, 2024

  • CVE-2020-35627
    36Monitor

    Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute a

    HighCVSS 8.8No exploitEPSS 2%

    woocommerce · gift cardsDec 28, 2020

  • CVE-2017-18356
    36Monitor

    In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user a

    HighCVSS 8.8No exploitEPSS 1%

    woocommerce · woocommerceJan 15, 2019

  • CVE-2023-33318
    35Monitor

    WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File Upload

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · automatewooDec 20, 2023

  • CVE-2019-20891
    35Monitor

    WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · woocommerceJun 19, 2020

  • CVE-2024-24799
    35Monitor

    WordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · box officeMar 26, 2024

  • CVE-2023-36514
    35Monitor

    WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · shipping multiple addressesJul 17, 2023

  • CVE-2023-32794
    35Monitor

    WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · product addonsNov 9, 2023

  • CVE-2023-32744
    35Monitor

    WordPress WooCommerce Product Recommendations Plugin < 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · product recommendationsNov 9, 2023

  • CVE-2023-32745
    35Monitor

    WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · automatewooNov 9, 2023

  • CVE-2023-35917
    35Monitor

    WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · paypal paymentsJun 22, 2023

  • CVE-2023-52222
    35Monitor

    WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · woocommerceJan 8, 2024

  • CVE-2023-35880
    35Monitor

    WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · brandsJul 17, 2023

  • CVE-2023-44999
    35Monitor

    WordPress WooCommerce Stripe Gateway plugin <= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · stripe payment gatewayMar 27, 2024

  • CVE-2023-36511
    35Monitor

    WordPress WooCommerce Order Barcodes Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · woocommerce order barcodesJul 17, 2023

  • CVE-2023-33316
    35Monitor

    WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · automatewooMay 28, 2023

  • CVE-2023-36513
    35Monitor

    WordPress AutomateWoo Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    woocommerce · automatewooJul 17, 2023

  • CVE-2018-20714
    33Monitor

    The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability.

    HighCVSS 8.1No exploitEPSS 1%

    woocommerce · woocommerceJan 15, 2019

  • CVE-2023-33330
    32Monitor

    WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL Injection

    HighCVSS 8.1No exploitEPSS 0%

    woocommerce · automatewooDec 20, 2023

  • CVE-2023-49817
    32Monitor

    WordPress Flexible Woocommerce Checkout Field Editor plugin <= 2.0.1 - Broken Access Control vulnerability

    HighCVSS 8.2No exploitEPSS 0%

    heolixfy · flexible woocommerce checkout field editorDec 9, 2024

  • CVE-2023-34000
    30Monitor

    WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR)

    HighCVSS 7.5No exploitEPSS 1%

    woocommerce · stripe payment gatewayJun 14, 2023

  • CVE-2020-11497
    30Monitor

    An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress.

    HighCVSS 7.5No exploitEPSS 1%

    woocommerce · nab transactAug 26, 2020

  • CVE-2024-10567
    30Monitor

    TI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access

    HighCVSS 7.5No exploitEPSS 0%

    templateinvaders · ti woocommerce wishlistDec 4, 2024