WooCommerce vulnerabilities and fixes

CVEs that mention WooCommerce, ranked by priority. 47 tracked.

WooCommerce has 47 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 26. Most recent: 2026-10-24. Highest priority: CVE-2026-8457 (score 56/100).

• CVE-2026-8457 CRITICAL 9.8 The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up
• CVE-2026-40725 CRITICAL 9.8 Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.
• CVE-2026-28005 CRITICAL 9.8 Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
• CVE-2026-55826 HIGH 8.7 The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites
• CVE-2026-66436 CRITICAL 9.3 Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.
• CVE-2026-14270 HIGH 8.8 The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is
• CVE-2026-73181 HIGH 7.5 Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
• CVE-2026-66462 HIGH 7.5 Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.
• CVE-2023-28665 MEDIUM 5.4 UPGRADE The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripti
• CVE-2026-27345 HIGH 7.5 Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.
• CVE-2026-59530 HIGH 7.5 Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.
• CVE-2026-59547 HIGH 7.5 Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.
• CVE-2026-66431 HIGH 7.5 Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.
• CVE-2026-66466 HIGH 7.5 Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Dir
• CVE-2026-22335 HIGH 8.5 Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.
• CVE-2026-39472 HIGH 7.2 Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
• CVE-2026-73398 MEDIUM 6.5 Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.
• CVE-2026-73399 MEDIUM 6.5 Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.
• CVE-2026-39470 HIGH 7.2 Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.
• CVE-2026-65559 HIGH 7.2 Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.
• CVE-2026-57425 MEDIUM 6.5 Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.
• CVE-2026-59537 HIGH 7.6 Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10
• CVE-2026-65532 HIGH 7.6 Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.
• CVE-2026-73346 HIGH 7.6 Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
• CVE-2026-73396 HIGH 7.1 Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.
• CVE-2026-114191 HIGH 7.5 Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-paymen
• CVE-2026-28169 MEDIUM 5.3 Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
• CVE-2026-61945 MEDIUM 6.5 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCo
• CVE-2026-65434 MEDIUM 6.5 Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.
• CVE-2026-73345 HIGH 7.1 Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.
• CVE-2026-28180 MEDIUM 5.3 Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 ver
• CVE-2026-59512 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.
• CVE-2026-59556 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 ve
• CVE-2026-65501 MEDIUM 5.3 Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.
• CVE-2026-66468 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.
• CVE-2026-66655 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
• CVE-2026-66697 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2
• CVE-2026-66707 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.
• CVE-2026-66711 HIGH 7.1 Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
• CVE-2026-73353 MEDIUM 5.3 Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
• CVE-2026-74009 MEDIUM 5.3 Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.
• CVE-2025-62005 HIGH 7.1 Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomembe
• CVE-2026-105199 MEDIUM 6.8 The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in on
• CVE-2026-109934 MEDIUM 5.3 The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readab
• CVE-2026-66475 MEDIUM 5.9 Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce &#8211; Checkout Manager <= 3
• CVE-2026-66692 MEDIUM 4.3 Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommer
• CVE-2026-65457 MEDIUM 4.3 Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

FAQ

How do I fix WooCommerce vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is WooCommerce being exploited right now?

None of the tracked WooCommerce CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which WooCommerce CVE should I patch first?

CVE-2026-8457 currently ranks highest (56/100): The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up .

← Back to latest CVEs