Woocommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:woocommerce:woocommerce:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Woocommerce (c7b0e075-8e70-51f0-86a8-e45639512f20) |
|---|---|
| Product | Woocommerce (e4e5c5af-a0db-5c10-82a2-f04c245f795a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:composer/woocommerce/woocommerce |
purl2cpe | 2026-06-01 10:15:12.311069 |
pkg:github/woocommerce/woocommerce |
purl2cpe | 2026-06-01 10:15:12.311071 |
pkg:wordpress/woocommerce |
purl2cpe | 2026-06-01 10:15:12.311072 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-37297 |
vulnerable | 2026-06-08 06:39:47.073286 |
WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms
MEDIUM (5.4)
WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the `Sourcebuster.js` library and then inserted without proper sanitization to the classic checkout and registration forms. Versions 8.8.5 and 8.9.3 contain a patch for the issue. As a workaround, one may disable the Order Attribution feature.
Published: 2024-06-12T15:05:46.468Z
Updated: 2024-08-02T03:50:56.092Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10567 |
vulnerable | 2026-06-08 06:23:46.965722 |
TI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access
HIGH (7.5)
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wizard' function in all versions up to, and including, 2.9.1. This makes it possible for unauthenticated attackers to create new pages, modify plugin settings, and perform limited options updates.
Published: 2024-12-04T08:22:45.515Z
Updated: 2026-04-08T16:34:39.852Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-52222 |
vulnerable | 2026-06-08 06:17:54.493931 |
WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)
MEDIUM (4.3)
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2.
Published: 2024-01-08T18:53:05.442Z
Updated: 2026-04-28T16:09:07.249Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-32575 |
vulnerable | 2026-06-08 06:04:46.532334 |
WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.25 is vulnerable to Cross Site Scripting (XSS)
MEDIUM (5.9)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.25 versions.
Published: 2023-08-25T10:28:38.710Z
Updated: 2026-04-28T16:08:23.469Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2099 |
vulnerable | 2026-06-08 05:42:50.273348 |
WooCommerce < 6.6.0 - Admin+ Stored HTML Injection
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
Published: 2022-07-17T10:35:52.000Z
Updated: 2024-08-03T00:24:44.425Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0775 |
vulnerable | 2026-06-08 05:39:10.795984 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32790 |
vulnerable | 2026-06-08 05:32:08.039324 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24323 |
vulnerable | 2026-06-08 05:30:04.187127 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-29156 |
vulnerable | 2026-06-08 05:24:57.997996 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-9168 |
vulnerable | 2026-06-08 05:14:25.073193 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-20891 |
vulnerable | 2026-06-08 05:13:41.727850 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-20714 |
vulnerable | 2026-06-08 05:11:27.771939 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-18356 |
vulnerable | 2026-06-08 05:09:11.059778 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-10112 |
vulnerable | 2026-06-08 05:07:17.319736 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2329 |
vulnerable | 2026-06-08 05:06:34.799349 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.