Exposure of WooCommerce

Ecommerce, WordPress plugins
3,083
exposure score
553,677
sites use
0
exploited
207
critical

CVEs

2,653 results
CVE-2026-14289CRITICALWP FacturaONE < 5.37 - Unauthenticated Remote Code ExecutionEPSS 0.7%CVE-2025-39364HIGHWordPress Product Category Slider for WooCommerce plugin <= 4.3.4 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2023-6327MEDIUMShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_productsEPSS 0.7%CVE-2021-39347MEDIUMStripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account HijackingEPSS 0.7%CVE-2026-18442HIGHWCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' ParameterEPSS 0.7%CVE-2023-37972MEDIUMWordPress WooCommerce Product Stock Alert Plugin <= 2.0.1 is vulnerable to Sensitive Data ExposureEPSS 0.7%CVE-2022-2099—WooCommerce < 6.6.0 - Admin+ Stored HTML InjectionEPSS 0.7%CVE-2024-3934MEDIUMMercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File DownloadEPSS 0.7%CVE-2023-4216LOWOrders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/ReadEPSS 0.7%CVE-2023-4603MEDIUMStar CloudPRNT for WooCommerce <= 2.0.3 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2026-115346HIGHAvada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload FieldEPSS 0.7%CVE-2026-15291HIGHChat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information ExposureEPSS 0.7%CVE-2023-35881HIGHWordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2024-1668MEDIUMAvada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form EntriesEPSS 0.7%CVE-2022-3537HIGHRole Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File UploadEPSS 0.7%CVE-2021-4347CRITICALAdvanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options ChangeEPSS 0.7%CVE-2024-0610CRITICALPiraeus Bank WooCommerce Payment Gateway <= 1.6.5.1 - Unauthenticated SQL InjectionEPSS 0.7%CVE-2022-36284MEDIUMWordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Authenticated IDOR vulnerability leading to PayPal email changeEPSS 0.7%CVE-2022-0426—Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2025-7654HIGHMultiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel LibraryEPSS 0.6%