GCVE - cpe:2.3:a:automattic:woocommerce:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:automattic:woocommerce:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Automattic (`1dc39c9b-4ddb-5af6-acf4-410b436129a9`)
Product	Woocommerce (`9da57e16-55d4-502c-b24f-e40a2029679a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-3589`	vulnerable	2026-06-08 08:01:19.019970	WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example. Published: 2026-03-06T09:11:10.949Z Updated: 2026-03-06T17:44:58.613Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/ https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-5062`	vulnerable	2026-06-08 07:35:24.077272	WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting MEDIUM (6.1) The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and including, 9.4.2 due to insufficient input sanitization and output escaping on PostMessage data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Published: 2025-05-22T03:42:08.044Z Updated: 2026-04-08T17:23:41.731Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ee5bb-eeb8-4134-8f3f-b411e56457f0?source=cve https://github.com/woocommerce/woocommerce/blob/08dbc3b7dea140dd5dc19ee9c9ecd47dac0605b6/plugins/woocommerce/client/admin/client/customize-store/utils.js#L39C1-L56C2 https://developer.woocommerce.com/2024/12/03/woocommerce-9-4-3-and-woocommerce-9-3-4-available-now/ https://github.com/woocommerce/woocommerce/pull/53405/files	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-49042`	vulnerable	2026-06-08 07:29:12.499872	WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability MEDIUM (5.9) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 10.0.2. Published: 2025-10-29T04:50:12.507Z Updated: 2026-04-28T16:12:58.197Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-10-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-26762`	vulnerable	2026-06-08 07:14:50.403980	WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability MEDIUM (5.9) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 9.7.0. Published: 2025-03-27T15:52:22.683Z Updated: 2026-04-28T16:11:40.353Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-9-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-15033`	vulnerable	2026-06-08 07:06:35.587529	WooCommerce - Subscriber/Customer+ Order Data Disclosure A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier. Published: 2025-12-22T18:57:39.687Z Updated: 2026-03-06T09:09:36.936Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/f55fd7d3-7fbe-474f-9406-f47f8aee5e57/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-9944`	vulnerable	2026-06-08 07:00:28.952510	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-39666`	vulnerable	2026-06-08 06:41:51.315001	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-35777`	vulnerable	2026-06-08 06:39:42.721338	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-22155`	vulnerable	2026-06-08 06:29:33.958719	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-7320`	vulnerable	2026-06-08 06:21:57.548893	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-52222`	vulnerable	2026-06-08 06:17:54.492939	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-47777`	vulnerable	2026-06-08 06:14:25.564422	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24323`	vulnerable	2026-06-08 05:30:04.186439	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.