Exposure of WooCommerce

Ecommerce, WordPress plugins
3,083
exposure score
553,677
sites use
0
exploited
207
critical

CVEs

2,653 results
CVE-2025-32568CRITICALWordPress EmpikPlace for Woocommerce Plugin <= 1.4.3 - PHP Object Injection vulnerabilityEPSS 0.9%CVE-2024-2381HIGHAliExpress Dropshipping with AliNext Lite <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.9%CVE-2026-16078MEDIUMWCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' ParameterEPSS 0.9%CVE-2022-25649MEDIUMWordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Multiple Improper Access Control vulnerabilitiesEPSS 0.9%CVE-2021-25043—WOOCS < 1.3.7.3 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2026-1988HIGHFlexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode AttributeEPSS 0.9%CVE-2022-4118CRITICALBitcoin / AltCoin Payment Gateway <= 1.7.1 - Unauthenticated SQLiEPSS 0.9%CVE-2024-0952HIGHWP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via idEPSS 0.9%CVE-2026-76009HIGHNext-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration EndpointEPSS 0.9%CVE-2026-18431CRITICALAvada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File WriteEPSS 0.9%CVE-2021-38349MEDIUMIntegration of Moneybird for WooCommerce <= 2.1.1 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2025-1913HIGHProduct Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data ParameterEPSS 0.9%CVE-2021-24928—Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL InjectionEPSS 0.9%CVE-2026-15014CRITICALSMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' ParameterEPSS 0.9%CVE-2021-25062—Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-4331HIGHThe Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Privilege EscalationEPSS 0.9%CVE-2024-3957MEDIUMBooster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.9%CVE-2026-4001CRITICALWoocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing FormulaEPSS 0.9%CVE-2023-5957HIGHNi Purchase Order(PO) For WooCommerce <= 1.2.1 - Admin+ File Upload to Remote Code ExecutionEPSS 0.9%CVE-2021-25077—Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site ScriptingEPSS 0.9%