Exposure of WooCommerce

Ecommerce, WordPress plugins
3,083
exposure score
553,677
sites use
0
exploited
207
critical

CVEs

2,653 results
CVE-2025-31405HIGHWordPress Fami WooCommerce Compare plugin <= 1.0.5 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2026-16062MEDIUMEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ ContentEPSS 0.6%CVE-2024-2203MEDIUMThe Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients WidgetEPSS 0.6%CVE-2024-9944MEDIUMWooCommerce <= 9.0.2 - Unauthenticated HTML InjectionEPSS 0.6%CVE-2025-30879HIGHWordPress MC Woocommerce Wishlist plugin <= 1.8.9 - SQL Injection vulnerabilityEPSS 0.6%CVE-2023-48333MEDIUMWordPress Booster for WooCommerce Plugin <= 7.1.1 is vulnerable to Sensitive Data ExposureEPSS 0.6%CVE-2024-0976MEDIUMWP Event Manager <= 3.1.41 - Reflected Cross-Site Scripting via pluginEPSS 0.6%CVE-2024-33628HIGHWordPress XforWooCommerce plugin <= 2.0.2 - Authenticated Local File Inclusion vulnerabilityEPSS 0.6%CVE-2024-35658HIGHWordPress Checkout Field Editor for WooCommerce (Pro) plugin <= 3.6.2 - Unauthenticated Arbitrary File Deletion vulnerabilityEPSS 0.6%CVE-2021-24262—WooLentor - WooCommerce Elementor Addons + Builder < 1.8.6 - Contributor+ Stored XSSEPSS 0.6%CVE-2024-37932HIGHWordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Arbitrary File Deletion vulnerabilityEPSS 0.6%CVE-2026-7547MEDIUMWoosa <= 2.0.5 - Authenticated (Administrator+) Arbitrary File Read via 'log_file' ParameterEPSS 0.6%CVE-2023-40010CRITICALWordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin <= 1.3.4.2 is vulnerable to SQL InjectionEPSS 0.6%CVE-2023-49817HIGHWordPress Flexible Woocommerce Checkout Field Editor plugin <= 2.0.1 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-5703MEDIUMGift Up Gift Cards for WordPress and WooCommerce <= 2.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-34812MEDIUMWordPress ShopBuilder plugin <= 2.1.8 - Sensitive Data Exposure vulnerabilityEPSS 0.6%CVE-2024-13831HIGHTabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabsEPSS 0.6%CVE-2026-10628MEDIUMPoints and Rewards for WooCommerce <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX ActionsEPSS 0.6%CVE-2024-21747HIGHWordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL InjectionEPSS 0.6%CVE-2024-9289CRITICALWordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege EscalationEPSS 0.6%