EN ES
Start free
Menu

WooCommerce: known security problems

47 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 47 known security problems on this page. Each one has a fixed version. Updating to version 11.2.0 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone with a shop manager account on your site could take over your site as an admin

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 9.8.0 up to and including 11.1.2
Fixed in
11.2.0
What to do
If your site has an affected version, update WooCommerce to version 11.2.0 or newer.
Official ID
CVE-2026-106608
Report title
WooCommerce 9.8.0 - 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation
First reported
Sources
This week

A stranger could slow down or crash your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 11.1.0
Fixed in
11.1.0
What to do
If your site has an affected version, update WooCommerce to version 11.1.0 or newer.
Official ID
CVE-2026-48888
Report title
WooCommerce < 11.1.0 - Unauthenticated Denial of Service
First reported
Sources
This week

Someone with a shop manager account on your site could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 10.9.4
Fixed in
11.0
What to do
If your site has an affected version, update WooCommerce to version 11.0 or newer.
Official ID
CVE-2026-57777
Report title
WooCommerce <= 10.9.4 - Authenticated (Shop Manager+) SQL Injection
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (before 10.5.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 10.5.3
Fixed in
10.5.3
What to do
If your site has an affected version, update WooCommerce to version 10.5.3 or newer.
Official ID
CVE-2026-3589
Report title
WooCommerce < 10.5.3 - Cross-Site Request Forgery
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 10.0 up to and including 10.0.4
  • From 10.1 up to and including 10.1.2
  • From 10.2 up to and including 10.2.2
  • From 10.3 up to and including 10.3.6
  • From 8.1 up to and including 8.1.2
  • From 8.2 up to and including 8.2.3
  • From 8.3 up to and including 8.3.2
  • From 8.4 up to and including 8.4.1
  • From 8.5 up to and including 8.5.3
  • From 8.6 up to and including 8.6.2
  • From 8.7 up to and including 8.7.1
  • From 8.8 up to and including 8.8.5
  • From 8.9 up to and including 8.9.3
  • From 9.0 up to and including 9.0.2
  • From 9.1 up to and including 9.1.4
  • From 9.2 up to and including 9.2.3
  • From 9.3 up to and including 9.3.4
  • From 9.4 up to and including 9.4.3
  • From 9.5 up to and including 9.5.2
  • From 9.6 up to and including 9.6.2
  • From 9.7 up to and including 9.7.1
  • From 9.8 up to and including 9.8.5
  • From 9.9 up to and including 9.9.5
Fixed in
8.1.3, 8.2.4, 8.3.3, 8.4.2, 8.5.4, 8.6.3, 8.7.2, 8.8.6, 8.9.4, 9.0.3, 9.1.5, 9.2.4, 9.3.5, 9.4.4, 9.5.3, 9.6.3, 9.7.2, 9.8.6, 9.9.6, 10.0.5, 10.1.3, 10.2.3, 10.3.7
What to do
If your site has an affected version, update WooCommerce to version 10.3.7 or newer.
Official ID
CVE-2025-15033
Report title
WooCommerce <= 10.4.2 - Authenticated (Subscriber+) Information Exposure
First reported
Sources
This week

Someone with a shop manager account on your site could plant harmful code that runs for your visitors or admins (up to and including 10.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 10.0.2
Fixed in
10.0.3
What to do
If your site has an affected version, update WooCommerce to version 10.0.3 or newer.
Official ID
CVE-2025-49042
Report title
WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 9.3.2; from 9.4 up to and including 9.4.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 9.3.2
  • From 9.4 up to and including 9.4.2
Fixed in
9.3.4, 9.4.3
What to do
If your site has an affected version, update WooCommerce to version 9.4.3 or newer.
Official ID
CVE-2025-5062
Report title
WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting
First reported
Sources
This week

Someone with a shop manager account on your site could plant harmful code that runs for your visitors or admins (up to and including 9.7.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 9.7.0
Fixed in
9.7.1
What to do
If your site has an affected version, update WooCommerce to version 9.7.1 or newer.
Official ID
CVE-2025-26762
Report title
WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 9.0.2
Fixed in
9.1.0
What to do
If your site has an affected version, update WooCommerce to version 9.1.0 or newer.
Official ID
CVE-2024-9944
Report title
WooCommerce <= 9.0.2 - Unauthenticated HTML Injection
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 9.1.2
Fixed in
9.1.3
What to do
If your site has an affected version, update WooCommerce to version 9.1.3 or newer.
Official ID
CVE-2024-39666
Report title
WooCommerce <= 9.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a shop manager account on your site could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 8.9.2
Fixed in
9.0.0
What to do
If your site has an affected version, update WooCommerce to version 9.0.0 or newer.
Official ID
CVE-2024-35777
Report title
WooCommerce <= 8.9.2 - Authenticated (Shop Manager+) Content Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (from 8.8.0 up to and including 8.8.4; from 8.9.0 up to and including 8.9.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 8.8.0 up to and including 8.8.4
  • From 8.9.0 up to and including 8.9.2
Fixed in
8.8.5, 8.9.3
What to do
If your site has an affected version, update WooCommerce to version 8.9.3 or newer.
Official ID
CVE-2024-37297
Report title
WooCommerce 8.8.0 - 8.9.2 - Reflected Cross-Site Scripting via Order Attribution
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 8.5.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 8.5.2
Fixed in
8.6.0
What to do
If your site has an affected version, update WooCommerce to version 8.6.0 or newer.
Official ID
CVE-2024-22155
Report title
WooCommerce <= 8.5.2 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 8.4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 8.4.0
Fixed in
8.4.0
What to do
If your site has an affected version, update WooCommerce to version 8.4.0 or newer.
Report title
WooCommerce < 8.4.0 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 8.2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 8.2.2
Fixed in
8.3.0
What to do
If your site has an affected version, update WooCommerce to version 8.3.0 or newer.
Official ID
CVE-2023-52222
Report title
WooCommerce <= 8.2.2 - Cross-Site Request Forgery
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 8.1.1
Fixed in
8.2.0
What to do
If your site has an affected version, update WooCommerce to version 8.2.0 or newer.
Official ID
CVE-2023-47777
Report title
WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute
First reported
Sources
This week

Someone could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 7.8.2
Fixed in
7.9.0
What to do
If your site has an affected version, update WooCommerce to version 7.9.0 or newer.
Official ID
CVE-2023-7320
Report title
WooCommerce <= 7.8.2 - Sensitive Information Exposure
First reported
Sources
This week

Someone with a shop manager account on your site could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 7.0.0
Fixed in
7.0.1
What to do
If your site has an affected version, update WooCommerce to version 7.0.1 or newer.
Report title
WooCommerce <= 7.0.0 - Authenticated(Shop Manager+) Sensitive Information Exposure
First reported
Sources
This week

Someone could use it to harm your site (before 6.6.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 6.6.0
Fixed in
6.6.0
What to do
If your site has an affected version, update WooCommerce to version 6.6.0 or newer.
Official ID
CVE-2022-2099
Report title
WooCommerce <= 6.5.1 - Authenticated (Admin+) HTML Injection
First reported
Sources
This week

Someone could use it to harm your site (before 4.0; from 4.0 up to, but not including, 4.0.3; from 4.1 up to, but not including, 4.1.3; from 4.2 up to, but not including, 4.2.4; from 4.3 up to, but not including, 4.3.5; from 4.4 up to, but not including, 4.4.3; from 4.5 up to, but not including, 4.5.4; from 4.6 up to, but not including, 4.6.4; from 4.7 up to, but not including, 4.7.3; from 4.8 up to, but not including, 4.8.2; from 4.9 up to, but not including, 4.9.4; from 5.0 up to, but not including, 5.0.2; from 5.1 up to, but not including, 5.1.2; from 5.2 up to, but not including, 5.2.4; from 5.3 up to, but not including, 5.3.2; from 5.4 up to, but not including, 5.4.3; from 5.5 up to, but not including, 5.5.3; from 5.6 up to, but not including, 5.6.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.0
  • From 4.0 up to, but not including, 4.0.3
  • From 4.1 up to, but not including, 4.1.3
  • From 4.2 up to, but not including, 4.2.4
  • From 4.3 up to, but not including, 4.3.5
  • From 4.4 up to, but not including, 4.4.3
  • From 4.5 up to, but not including, 4.5.4
  • From 4.6 up to, but not including, 4.6.4
  • From 4.7 up to, but not including, 4.7.3
  • From 4.8 up to, but not including, 4.8.2
  • From 4.9 up to, but not including, 4.9.4
  • From 5.0 up to, but not including, 5.0.2
  • From 5.1 up to, but not including, 5.1.2
  • From 5.2 up to, but not including, 5.2.4
  • From 5.3 up to, but not including, 5.3.2
  • From 5.4 up to, but not including, 5.4.3
  • From 5.5 up to, but not including, 5.5.3
  • From 5.6 up to, but not including, 5.6.1
Fixed in
4.0.3, 4.1.3, 4.2.4, 4.3.5, 4.4.3, 4.5.4, 4.6.4, 4.7.3, 4.8.2, 4.9.4, 5.0.2, 5.1.2, 5.2.4, 5.3.2, 5.4.3, 5.5.3, 5.6.1, 5.7.0
What to do
If your site has an affected version, update WooCommerce to version 5.7.0 or newer.
Report title
WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Information Disclosure
First reported
Sources
This week

Someone could use it to harm your site (from 3.5 up to, but not including, 3.5.10; from 3.6 up to, but not including, 3.6.7; from 3.7 up to, but not including, 3.7.3; from 3.8 up to, but not including, 3.8.3; from 3.9 up to, but not including, 3.9.5; from 4.0 up to, but not including, 4.0.4; from 4.1 up to, but not including, 4.1.4; from 4.2 up to, but not including, 4.2.5; from 4.3 up to, but not including, 4.3.6; from 4.4 up to, but not including, 4.4.4; from 4.5 up to, but not including, 4.5.5; from 4.6 up to, but not including, 4.6.5; from 4.7 up to, but not including, 4.7.4; from 4.8 up to, but not including, 4.8.3; from 4.9 up to, but not including, 4.9.5; from 5.0 up to, but not including, 5.0.3; from 5.1 up to, but not including, 5.1.3; from 5.2 up to, but not including, 5.2.5; from 5.3 up to, but not including, 5.3.3; from 5.4 up to, but not including, 5.4.4; from 5.5 up to, but not including, 5.5.4; from 5.6 up to, but not including, 5.6.2; from 5.7 up to, but not including, 5.7.2; from 5.8 up to, but not including, 5.8.1; from 5.9 up to, but not including, 5.9.1; from 6.0 up to, but not including, 6.0.1; from 6.1 up to, but not including, 6.1.2; from 6.2 up to, but not including, 6.2.2; from 6.3 up to, but not including, 6.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.5 up to, but not including, 3.5.10
  • From 3.6 up to, but not including, 3.6.7
  • From 3.7 up to, but not including, 3.7.3
  • From 3.8 up to, but not including, 3.8.3
  • From 3.9 up to, but not including, 3.9.5
  • From 4.0 up to, but not including, 4.0.4
  • From 4.1 up to, but not including, 4.1.4
  • From 4.2 up to, but not including, 4.2.5
  • From 4.3 up to, but not including, 4.3.6
  • From 4.4 up to, but not including, 4.4.4
  • From 4.5 up to, but not including, 4.5.5
  • From 4.6 up to, but not including, 4.6.5
  • From 4.7 up to, but not including, 4.7.4
  • From 4.8 up to, but not including, 4.8.3
  • From 4.9 up to, but not including, 4.9.5
  • From 5.0 up to, but not including, 5.0.3
  • From 5.1 up to, but not including, 5.1.3
  • From 5.2 up to, but not including, 5.2.5
  • From 5.3 up to, but not including, 5.3.3
  • From 5.4 up to, but not including, 5.4.4
  • From 5.5 up to, but not including, 5.5.4
  • From 5.6 up to, but not including, 5.6.2
  • From 5.7 up to, but not including, 5.7.2
  • From 5.8 up to, but not including, 5.8.1
  • From 5.9 up to, but not including, 5.9.1
  • From 6.0 up to, but not including, 6.0.1
  • From 6.1 up to, but not including, 6.1.2
  • From 6.2 up to, but not including, 6.2.2
  • From 6.3 up to, but not including, 6.3.1
Fixed in
3.5.10, 3.6.7, 3.7.3, 3.8.3, 3.9.5, 4.0.4, 4.1.4, 4.2.5, 4.3.6, 4.4.4, 4.5.5, 4.6.5, 4.7.4, 4.8.3, 4.9.5, 5.0.3, 5.1.3, 5.2.5, 5.3.3, 5.4.4, 5.5.4, 5.6.2, 5.7.2, 5.8.1, 5.9.1, 6.0.1, 6.1.2, 6.2.2, 6.3.1
What to do
If your site has an affected version, update WooCommerce to version 6.3.1 or newer.
Report title
WooCommerce < 6.3.1 - Unauthorized Order Status Change
First reported
Sources
This week

Someone could use it to harm your site (up to and including 6.2.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.2.0
Fixed in
6.2.1
What to do
If your site has an affected version, update WooCommerce to version 6.2.1 or newer.
Official ID
CVE-2022-0775
Report title
WooCommerce <= 6.2.0 - Incorrect Authorization Checks on REST API Endpoints
First reported
Sources
This week

Someone could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 6.2.0
Fixed in
6.2.1
What to do
If your site has an affected version, update WooCommerce to version 6.2.1 or newer.
Report title
WooCommerce <= 6.2.0 - Path Traversal via Tax Importer
First reported
Sources
This week

Someone could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.3
  • From 3.3 up to and including 3.3.5
  • From 3.4 up to and including 3.4.7
  • From 3.5 up to and including 3.5.8
  • From 3.6 up to and including 3.6.5
  • From 3.7 up to and including 3.7.1
  • From 3.8 up to and including 3.8.1
  • From 3.9 up to and including 3.9.3
  • From 4.0 up to and including 4.0.1
  • From 4.1 up to and including 4.1.1
  • From 4.2 up to and including 4.2.2
  • From 4.3 up to and including 4.3.3
  • From 4.4 up to and including 4.4.1
  • From 4.5 up to and including 4.5.2
  • From 4.6 up to and including 4.6.2
  • From 4.7 up to and including 4.7.1
  • From 4.8 up to and including 4.8
  • From 4.9 up to and including 4.9.2
  • From 5.0 up to and including 5.0
  • From 5.1 up to and including 5.1
  • From 5.2 up to and including 5.2.2
  • From 5.3 up to and including 5.3
  • From 5.4 up to and including 5.4.1
  • From 5.5 up to and including 5.5
Fixed in
3.3.6, 3.4.8, 3.5.9, 3.6.6, 3.7.2, 3.8.2, 3.9.4, 4.0.2, 4.1.2, 4.2.3, 4.3.4, 4.4.2, 4.5.3, 4.6.3, 4.7.2, 4.8.1, 4.9.3, 5.0.1, 5.1.1, 5.2.3, 5.3.1, 5.4.2, 5.5.1, 5.5.2
What to do
If your site has an affected version, update WooCommerce to version 5.5.2 or newer.
Official ID
CVE-2021-32790
Report title
WooCommerce < 5.5 - Authenticated Blind SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 5.2.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 5.2.0
Fixed in
5.2.0
What to do
If your site has an affected version, update WooCommerce to version 5.2.0 or newer.
Official ID
CVE-2021-24323
Report title
WooCommerce <= 5.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (before 4.6.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.6.2
Fixed in
4.6.2
What to do
If your site has an affected version, update WooCommerce to version 4.6.2 or newer.
Report title
WooCommerce <= 4.6.1 & WooCommerce Blocks <= 3.7.0 - Settings Bypass leading to Account Creation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 4.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.2.1
Fixed in
4.2.1
What to do
If your site has an affected version, update WooCommerce to version 4.2.1 or newer.
Report title
WooCommerce <= 4.2.0 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (before 4.1.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.1.0
Fixed in
4.1.0
What to do
If your site has an affected version, update WooCommerce to version 4.1.0 or newer.
Report title
WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification
First reported
Sources
This week

Someone could use it to harm your site (before 4.7.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.7.0
Fixed in
4.7.0
What to do
If your site has an affected version, update WooCommerce to version 4.7.0 or newer.
Official ID
CVE-2020-29156
Report title
WooCommerce < 4.7.0 - Insecure Direct Object Reference via order_id Parameter
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.6.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.4
Fixed in
3.6.5
What to do
If your site has an affected version, update WooCommerce to version 3.6.5 or newer.
Report title
WooCommerce <= 3.6.4 - Missing File Type Validation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.6.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.6.5
Fixed in
3.6.5
What to do
If your site has an affected version, update WooCommerce to version 3.6.5 or newer.
Report title
WooCommerce <= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.5.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.5.5
Fixed in
3.5.5
What to do
If your site has an affected version, update WooCommerce to version 3.5.5 or newer.
Official ID
CVE-2019-9168
Report title
WooCommerce <= 3.5.4 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.5.1
Fixed in
3.5.2
What to do
If your site has an affected version, update WooCommerce to version 3.5.2 or newer.
Report title
WooCommerce <= 3.5.1 - Authenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (before 3.4.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.4.6
Fixed in
3.4.6
What to do
If your site has an affected version, update WooCommerce to version 3.4.6 or newer.
Official ID
CVE-2018-20714
Report title
WooCommerce <= 3.4.5 - WooCommerce File Deletion
First reported
Sources
This week

Someone could in some setups, take over your site (before 3.4.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.4.5
Fixed in
3.4.5
What to do
If your site has an affected version, update WooCommerce to version 3.4.5 or newer.
Report title
WooCommerce <= 3.4.4 - Authenticated PHP Object Injection
First reported
Sources
This week

Someone could in some setups, take over your site (before 3.2.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.4
Fixed in
3.2.4
What to do
If your site has an affected version, update WooCommerce to version 3.2.4 or newer.
Official ID
CVE-2017-18356
Report title
WooCommerce <= 3.2.3 - Authenticated PHP Object Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.6.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.6.9
Fixed in
2.6.9
What to do
If your site has an affected version, update WooCommerce to version 2.6.9 or newer.
Official ID
CVE-2016-10112
Report title
WooCommerce <= 2.6.8 - Authenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.6.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.6.4
Fixed in
2.6.4
What to do
If your site has an affected version, update WooCommerce to version 2.6.4 or newer.
Report title
WooCommerce <= 2.6.3 - Stored Cross-Site Scripting via REST-API
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.6.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.6.3
Fixed in
2.6.3
What to do
If your site has an affected version, update WooCommerce to version 2.6.3 or newer.
Report title
WooCommerce <= 2.6.2 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.4.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.4.9
Fixed in
2.4.9
What to do
If your site has an affected version, update WooCommerce to version 2.4.9 or newer.
Report title
WooCommerce < 2.4.9 - Cross-site Scripting
First reported
Sources
This week

Someone could in some setups, take over your site (up to and including 2.3.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.3.10
Fixed in
2.3.11
What to do
If your site has an affected version, update WooCommerce to version 2.3.11 or newer.
Report title
WooCommerce <= 2.3.10 - PHP Object Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.3.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.3.6
Fixed in
2.3.6
What to do
If your site has an affected version, update WooCommerce to version 2.3.6 or newer.
Official ID
CVE-2015-2329
Report title
WooCommerce <= 2.3.5 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.2.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.2.11
Fixed in
2.2.11
What to do
If your site has an affected version, update WooCommerce to version 2.2.11 or newer.
Official ID
CVE-2015-2069
Report title
WooCommerce <= 2.2.10 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.2.3
Fixed in
2.2.3
What to do
If your site has an affected version, update WooCommerce to version 2.2.3 or newer.
Report title
WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.2.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.2.3
Fixed in
2.2.3
What to do
If your site has an affected version, update WooCommerce to version 2.2.3 or newer.
Official ID
CVE-2014-6313
Report title
WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.17)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.17
Fixed in
2.0.18
What to do
If your site has an affected version, update WooCommerce to version 2.0.18 or newer.
Report title
WooCommerce <= 2.0.17 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.12
Fixed in
2.0.13
What to do
If your site has an affected version, update WooCommerce to version 2.0.13 or newer.
Report title
WooCommerce <= 2.0.12 - Self-Reflected Cross-Site Scripting
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)