WordPress woocommerce has 15 known advisories in the phpwarden feed. Feed 2026.10.29.3, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2017-17058 | The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/ema | high | 7.5 | <=3.2.6 | – |
| CVE-2020-29156 | The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter | medium | 5.3 | <4.7.0 | 4.7.0 |
| CVE-2015-2069 | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary w | medium | 4.3 | <=2.2.10 | – |
| CVE-2014-6313 | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary we | medium | 4.3 | <=2.2.2 or =2.1.0 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.4 or =2.1.5 or =2.1.6 or =2.1.7 or =2.1.8 or =2.1.9 or =2.1.10 or =2.1.11 or =2.1.12 or =2.2.0 or =2.2.1 | – |
| CVE-2017-18356 | In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user a | high | 8.8 | <3.2.4 | 3.2.4 |
| CVE-2018-20714 | The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allo | high | 8.1 | <3.4.6 | 3.4.6 |
| CVE-2021-32790 | Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCo | medium | 4.9 | >=3.3.0 and <3.3.6 or >=3.4.0 and <3.4.8 or >=3.5.0 and <3.5.9 or >=3.6.0 and <3.6.6 or >=3.7.0 and <3.7.2 or >=3.8.0 and <3.8.2 or >=3.9.0 and <3.9.4 or >=4.0.0 and <4.0.2 or >=4.1.0 and <4.1.2 or >=4.2.0 and <4.2.3 or >=4.3.0 and <4.3.4 or >=4.4.0 and <4.4.2 or >=4.5.0 and <4.5.3 or >=4.6.0 and <4.6.3 or >=4.7.0 and <4.7.2 or >=4.8.0 and <4.8.1 or >=4.9.0 and <4.9.3 or >=5.0.0 and <5.0.1 or >=5.1.0 and <5.1.1 or >=5.2.0 and <5.2.3 or >=5.3.0 and <5.3.1 or >=5.4.0 and <5.4.2 or >=5.5.0 and <5.5.1 | 3.3.6, 3.4.8, 3.5.9, 3.6.6 |
| CVE-2015-2329 | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary we | medium | 6.1 | <2.3.6 | 2.3.6 |
| CVE-2016-10112 | Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to | medium | 4.8 | <=2.6.8 | – |
| CVE-2024-1310 | The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't h | medium | 4.9 | <8.6.0 | 8.6.0 |
| CVE-2022-0775 | The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenti | medium | 4.3 | <6.2.1 | 6.2.1 |
| CVE-2022-2099 | The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment g | medium | 4.8 | <6.6.0 | 6.6.0 |
| CVE-2024-9944 | The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin | medium | 5.3 | <9.1.0 | 9.1.0 |
| CVE-2024-37297 | WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site sc | medium | 5.4 | >=8.8 and <8.8.5 or >=8.9.0 and <8.9.3 | 8.8.5, 8.9.3 |
| CVE-2025-5062 | The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions | medium | 6.1 | <9.3.4 or >=9.4.0 and <9.4.3 | 9.3.4, 9.4.3 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden wordpress /var/www/html # or, without Composer pipx install phpwarden && phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked