WooCommerce
Automattic
Developer
10.9.4
Latest version
7,000,000
Installations
No date
Last updated
Vulnerability history
0 present
45 patched
6 Mitigation rules
- Arbitrary Admin User Creation via CSRF vulnerability< 10.5.310/03/2026
- Sensitive Data Exposure vulnerability<= 10.4.222/12/2025
- Sensitive Information Exposure vulnerability<= 7.8.229/10/2025
- Cross Site Scripting (XSS) vulnerability<= 10.0.229/10/2025
- PostMessage-Based Cross-Site Scripting<= 9.3.222/05/2025
- Cross Site Scripting (XSS) vulnerability<= 9.7.012/03/2025
- Unauthenticated Order Creation vulnerability< 9.4.304/12/2024
- Unauthenticated HTML Injection vulnerability<= 9.0.215/10/2024
- Cross Site Scripting (XSS) vulnerability<= 9.1.216/08/2024
- Content Injection vulnerability<= 8.9.227/06/2024
- Reflected Cross Site Scripting (XSS) vulnerability<= 8.9.211/06/2024
- Contributor+ Private/Draft Products Access vulnerability< 8.615/04/2024
- Cross Site Request Forgery (CSRF) vulnerability<= 8.5.205/04/2024
- Cross Site Request Forgery (CSRF) vulnerability<= 8.2.205/01/2024
- Reflected Cross-Site Scripting vulnerability<= 8.3.012/12/2023
- Contributor+ Cross Site Scripting (XSS) vulnerability<= 8.1.115/11/2023
- Authenticated Stored HTML Injection vulnerability<= 6.5.120/06/2022
- Orders Status Change (via PayPal Standard Gateway) vulnerability<= 6.3.010/03/2022
- Path Traversal via Importers vulnerability<= 6.2.023/02/2022
- Arbitrary Comment Deletion vulnerability<= 6.2.023/02/2022
- Analytics Report Leaks vulnerability<= 5.6.022/09/2021
- Unauthenticated SQL Injection (SQLi) vulnerability<= 5.5.015/07/2021
- Authenticated Persistent Cross-Site Scripting (XSS) vulnerability<= 5.1.029/04/2021
- Sensitive Information Disclosure vulnerability<= 4.6.210/11/2020
- Guest Account Creation vulnerability<= 4.6.106/11/2020
- Cross-Site Request Forgery (CSRF) vulnerability<= 3.6.407/07/2019
- Stored Cross-Site Scripting (XSS) vulnerability<= 3.5.426/02/2019
- Authenticated Stored Cross-Site Scripting (XSS) vulnerability<= 3.5.007/01/2019
- Authenticated Stored Cross-Site Scripting (XSS) vulnerability<= 3.4.511/12/2018
- Authenticated File Deletion to Privilege Escalation vulnerability<= 3.4.507/11/2018
- Authenticated Object Injection vulnerability<= 3.4.529/10/2018
- Potential Object Injection vulnerability<= 3.4.401/09/2018
- Authenticated PHP Object Injection vulnerability<= 3.2.323/02/2018
- Cross Site Scripting<= 2.6.803/01/2017
- Cross Site Scripting<= 2.6.309/09/2016
- Cross Site Scripting<= 2.6.220/07/2016
- Cross Site Scripting<= 2.4.817/11/2015
- Absolute Path Traversal<= 1.324/06/2015
- XXE<= 2.3.1017/06/2015
- Reflected XSS<= 2.1.1210/06/2015
- Reflected Cross Site Scripting<= 2.0.1715/05/2015
- Cross Site Scripting<= 2.0.1215/05/2015
- SQL Injection<= 2.3.515/05/2015
- XSS<= 2.2.1024/02/2015
- Cross-Site Scripting (XSS) vulnerability<= 2.2.211/09/2014