High
CVE-2025-27012
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2025-27343
WooCommerce HTML5 Video <= 1.7.10 - Reflected Cross-Site Scripting
Medium
CVE-2025-1288
WOOEXIM – WooCommerce Export Import Plugin <= 5.0.0 - Reflected Cross-Site Scripting
Medium
CVE-2024-13461
Autoship Cloud for WooCommerce Subscription Products <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13520
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.9 - Missing Authorization to Unauthenticated Price, Date, and Note Updates
High
CVE-2024-13792
WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids
Medium
CVE-2025-1064
Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode
Medium
CVE-2025-0864
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scripting
Medium
CVE-2024-13538
BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute
Medium
CVE-2024-13540
WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure
High
CVE-2024-13622
File Uploads Addon for WooCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
High
CVE-2024-13315
Shopwarden – Automated WooCommerce monitoring & testing <= 1.0.11 - Cross-Site Request Forgery to Arbitrary Options Update
High
CVE-2024-13797
PressMart - Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2024-13718
Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification
Medium
CVE-2025-1363
URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-1362
URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Cross-Site Request Forgery
Medium
CVE-2024-13525
Customer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure
Critical
CVE-2024-13513
Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation
Medium
CVE-2025-26775
BEAR <= 1.1.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-26750
Vitepos – Point of sale (POS) <= 3.1.3 - Missing Authorization
Medium
CVE-2024-13735
HurryTimer <= 2.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Name
Medium
CVE-2024-13692
Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2024-13641
Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Medium
CVE-2024-13868
URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.