Known vulnerabilities in WooCommerce
Everything you need to launch an online store in days and keep it growing for years. From your first sale to millions in revenue, Woo is with you.
46Reported vulnerabilities
8.8Highest CVSS score
11.0.1Latest version
7,000,000+Active installs
What to do now
Update WooCommerce to 5.4.4 or later.
45 of these have a fixed version available. Updating resolves them.
Reported vulnerabilities
| CVE | Severity | Exploit probability |
Affected versions | Fixed in | Published |
|---|---|---|---|---|---|
| CVE-2017-17058 | High | 23.7% | 3.2.6 and earlier | — | November 29, 2017 |
| CVE-2017-18356 | High | 2.0% | Before 3.2.4 | 3.2.4 |
January 15, 2019 |
| CVE-2020-29156 | Medium | 4.0% | Before 4.7.0 | 4.7.0 |
December 27, 2020 |
| CVE-2024-1310 | Medium | 0.7% | Before 8.6.0 | 8.6.0 |
April 15, 2024 |
| CVE-2015-2069 | Medium | 2.0% | 2.2.10 and earlier | 2.2.11 |
February 24, 2015 |
| CVE-2014-6313 | Medium | 2.0% | 2.2.2 and earlier 2.1.0 to 2.1.0 (inclusive) 2.1.1 to 2.1.1 (inclusive) 2.1.2 to 2.1.2 (inclusive) 2.1.3 to 2.1.3 (inclusive) 2.1.4 to 2.1.4 (inclusive) 2.1.5 to 2.1.5 (inclusive) 2.1.6 to 2.1.6 (inclusive) 2.1.7 to 2.1.7 (inclusive) 2.1.8 to 2.1.8 (inclusive) 2.1.9 to 2.1.9 (inclusive) 2.1.10 to 2.1.10 (inclusive) 2.1.11 to 2.1.11 (inclusive) 2.1.12 to 2.1.12 (inclusive) 2.2.0 to 2.2.0 (inclusive) 2.2.1 to 2.2.1 (inclusive) |
2.2.3 |
October 14, 2014 |
| CVE-2022-2099 | Medium | 0.6% | Before 6.6.0 | 6.6.0 |
July 17, 2022 |
| WF-c232b39c-7144-4d3a-9770-883986ca8b29 | High | — | Before 4.1.0 | 4.1.0 |
May 5, 2020 |
| WF-2edb574d-74b7-4f72-91a1-bb6632709b7a | High | — | Before 3.6.5 | 3.6.5 |
July 2, 2019 |
| CVE-2018-20714 | High | 1.8% | Before 3.4.6 | 3.4.6 |
January 15, 2019 |
| CVE-2022-0775 | Medium | 0.7% | Before 6.2.1 | 6.2.1 |
January 16, 2024 |
| CVE-2026-3589 | High | 0.1% | 5.4.0 up to (but not including) 5.4.4 5.5.0 up to (but not including) 5.4.5 5.6.0 up to (but not including) 5.6.3 5.7.0 up to (but not including) 5.7.3 5.8.0 up to (but not including) 5.8.2 5.9.0 up to (but not including) 5.9.2 6.0.0 up to (but not including) 6.0.2 6.1.0 up to (but not including) 6.1.3 6.2.0 up to (but not including) 6.2.3 6.3.0 up to (but not including) 6.3.2 6.4.0 up to (but not including) 6.4.2 6.5.0 up to (but not including) 6.5.2 6.6.0 up to (but not including) 6.6.2 6.7.0 up to (but not including) 6.7.1 6.8.0 up to (but not including) 6.8.3 6.9.0 up to (but not including) 6.9.5 7.0.0 up to (but not including) 7.0.2 7.1.0 up to (but not including) 7.1.2 7.2.0 up to (but not including) 7.2.4 7.3.0 up to (but not including) 7.3.1 7.4.0 up to (but not including) 7.4.2 7.5.0 up to (but not including) 7.5.2 7.6.0 up to (but not including) 7.6.2 7.7.0 up to (but not including) 7.7.3 7.8.0 up to (but not including) 7.8.4 7.9.0 up to (but not including) 7.9.2 8.0.0 up to (but not including) 8.0.5 8.1.0 up to (but not including) 8.1.4 8.2.0 up to (but not including) 8.2.5 8.3.0 up to (but not including) 8.3.4 8.4.0 up to (but not including) 8.4.3 8.5.0 up to (but not including) 8.5.5 8.6.0 up to (but not including) 8.6.4 8.7.0 up to (but not including) 8.7.3 8.8.0 up to (but not including) 8.8.7 8.9.0 up to (but not including) 8.9.5 9.0.0 up to (but not including) 9.0.4 9.1.0 up to (but not including) 9.1.7 9.2.0 up to (but not including) 9.2.5 9.3.0 up to (but not including) 9.3.6 9.4.0 up to (but not including) 9.4.5 9.5.0 up to (but not including) 9.5.4 9.6.0 up to (but not including) 9.6.4 9.7.0 up to (but not including) 9.7.3 9.8.0 up to (but not including) 9.8.7 9.9.0 up to (but not including) 9.9.7 10.0.0 up to (but not including) 10.0.6 10.1.0 up to (but not including) 10.1.4 10.2.0 up to (but not including) 10.2.4 10.3.0 up to (but not including) 10.3.8 10.4.0 up to (but not including) 10.4.4 10.5.0 up to (but not including) 10.5.3 |
5.4.4 |
March 6, 2026 |
| WF-88b3a69d-2c94-48e6-b965-8a67b2fe42b2 | High | — | 2.3.10 and earlier | 2.3.11 |
June 10, 2015 |
| WF-5cbf597e-7a2f-416c-8969-3679b487f57a | High | — | 6.2.0 and earlier | 6.2.1 |
February 22, 2022 |
| WF-162a194c-a7de-44c4-a659-8188e303b6a2 | High | — | 3.6.4 and earlier | 3.6.5 |
July 2, 2019 |
| CVE-2023-47777 | Medium | 0.8% | 8.1.1 and earlier | 8.2.0 |
November 15, 2023 |
| WF-7c32d967-85b9-4c93-a948-0126efb78f39 | Medium | — | Before 4.0 4.0 up to (but not including) 4.0.3 4.1 up to (but not including) 4.1.3 4.2 up to (but not including) 4.2.4 4.3 up to (but not including) 4.3.5 4.4 up to (but not including) 4.4.3 4.5 up to (but not including) 4.5.4 4.6 up to (but not including) 4.6.4 4.7 up to (but not including) 4.7.3 4.8 up to (but not including) 4.8.2 4.9 up to (but not including) 4.9.4 5.0 up to (but not including) 5.0.2 5.1 up to (but not including) 5.1.2 5.2 up to (but not including) 5.2.4 5.3 up to (but not including) 5.3.2 5.4 up to (but not including) 5.4.3 5.5 up to (but not including) 5.5.3 5.6 up to (but not including) 5.6.1 |
4.0.3 |
April 10, 2022 |
| WF-0c6a49d1-633b-47aa-8390-5df3bf8f71a5 | Medium | — | Before 4.6.2 | 4.6.2 |
November 5, 2020 |
| WF-6ab26526-9fbb-4c2e-be41-73450225b834 | Medium | — | Before 3.4.5 | 3.4.5 |
August 29, 2018 |
| CVE-2015-2329 | Medium | 1.2% | Before 2.3.6 | 2.3.6 |
February 8, 2018 |
| CVE-2019-9168 | Medium | 1.0% | Before 3.5.5 | 3.5.5 |
February 20, 2019 |
| WF-e10a95e3-e834-4f84-85c1-4a1ffad41b5b | Medium | — | Before 2.6.4 | 2.6.4 |
July 26, 2016 |
| WF-1e5e16c9-53d2-4fdd-8370-920b22f52033 | Medium | — | Before 2.6.3 | 2.6.3 |
July 19, 2016 |
| CVE-2025-5062 | Medium | 0.4% | 9.3.2 and earlier 9.4 to 9.4.2 (inclusive) |
9.3.4 |
May 21, 2025 |
| WF-43810a17-89b4-44f5-887e-1ad0989ea5b4 | Medium | — | Before 8.4.0 | 8.4.0 |
January 12, 2024 |
| WF-def0da23-248b-40e2-9d70-8dd1ecbe3d45 | Medium | — | Before 4.2.1 | 4.2.1 |
June 22, 2020 |
| WF-0324852f-9e19-467c-9b0b-4c9fe2dd1cc0 | Medium | — | Before 2.2.3 | 2.2.3 |
September 17, 2014 |
| WF-e1eeabdb-f1c0-49c5-9234-8ff4eaa38087 | Medium | — | 2.0.17 and earlier | 2.0.18 |
October 17, 2013 |
| WF-77f3db0c-d575-48a8-872a-a64fd77486de | Medium | — | 2.0.12 and earlier | 2.0.13 |
July 18, 2013 |
| CVE-2024-9944 | Medium | 0.6% | 9.0.2 and earlier | 9.1.0 |
October 14, 2024 |
| CVE-2024-37297 | Medium | 0.5% | 8.8 up to (but not including) 8.8.5 8.9.0 up to (but not including) 8.9.3 |
8.8.5 |
June 12, 2024 |
| WF-5193d1c0-5111-4e97-a433-a41a76acbde9 | Medium | — | 3.5.1 and earlier | 3.5.2 |
November 29, 2018 |
| WF-56953c6f-7ff9-45bf-9265-01240938e395 | Medium | — | Before 2.4.9 | 2.4.9 |
November 17, 2015 |
| CVE-2023-7320 | Medium | 0.3% | 7.8.2 and earlier | 7.9.0 |
September 11, 2023 |
| CVE-2021-32790 | Medium | 1.3% | 3.3.0 up to (but not including) 3.3.6 3.4.0 up to (but not including) 3.4.8 3.5.0 up to (but not including) 3.5.9 3.6.0 up to (but not including) 3.6.6 3.7.0 up to (but not including) 3.7.2 3.8.0 up to (but not including) 3.8.2 3.9.0 up to (but not including) 3.9.4 4.0.0 up to (but not including) 4.0.2 4.1.0 up to (but not including) 4.1.2 4.2.0 up to (but not including) 4.2.3 4.3.0 up to (but not including) 4.3.4 4.4.0 up to (but not including) 4.4.2 4.5.0 up to (but not including) 4.5.3 4.6.0 up to (but not including) 4.6.3 4.7.0 up to (but not including) 4.7.2 4.8.0 up to (but not including) 4.8.1 4.9.0 up to (but not including) 4.9.3 5.0.0 up to (but not including) 5.0.1 5.1.0 up to (but not including) 5.1.1 5.2.0 up to (but not including) 5.2.3 5.3.0 up to (but not including) 5.3.1 5.4.0 up to (but not including) 5.4.2 5.5.0 up to (but not including) 5.5.1 |
3.3.6 |
July 26, 2021 |
| CVE-2016-10112 | Medium | 0.9% | 2.6.8 and earlier | 2.6.9 |
January 4, 2017 |
| WF-f1efcff5-3af6-4c44-9654-b917523419aa | Medium | — | 7.0.0 and earlier | 7.0.1 |
September 11, 2023 |
| CVE-2021-24323 | Medium | 0.7% | Before 5.2.0 | 5.2.0 |
April 21, 2021 |
| CVE-2024-39666 | Medium | 0.4% | 9.1.2 and earlier | 9.1.3 |
August 16, 2024 |
| CVE-2025-15033 | Medium | 0.3% | 10.0 to 10.0.4 (inclusive) 10.1 to 10.1.2 (inclusive) 10.2 to 10.2.2 (inclusive) 10.3 to 10.3.6 (inclusive) 8.1 to 8.1.2 (inclusive) 8.2 to 8.2.3 (inclusive) 8.3 to 8.3.2 (inclusive) 8.4 to 8.4.1 (inclusive) 8.5 to 8.5.3 (inclusive) 8.6 to 8.6.2 (inclusive) 8.7 to 8.7.1 (inclusive) 8.8 to 8.8.5 (inclusive) 8.9 to 8.9.3 (inclusive) 9.0 to 9.0.2 (inclusive) 9.1 to 9.1.4 (inclusive) 9.2 to 9.2.3 (inclusive) 9.3 to 9.3.4 (inclusive) 9.4 to 9.4.3 (inclusive) 9.5 to 9.5.2 (inclusive) 9.6 to 9.6.2 (inclusive) 9.7 to 9.7.1 (inclusive) 9.8 to 9.8.5 (inclusive) 9.9 to 9.9.5 (inclusive) |
10.0.5 |
December 22, 2025 |
| CVE-2025-49042 | Medium | 0.2% | 10.0.2 and earlier | 10.0.3 |
October 29, 2025 |
| CVE-2025-26762 | Medium | 0.2% | 9.7.0 and earlier | 9.7.1 |
March 12, 2025 |
| CVE-2024-22155 | Medium | 0.2% | 8.5.2 and earlier | 8.6.0 |
April 5, 2024 |
| CVE-2023-52222 | Medium | 0.3% | 8.2.2 and earlier | 8.3.0 |
January 5, 2024 |
| WF-2ed1f200-5a27-4905-ac88-394b214bb430 | Medium | — | 3.5 up to (but not including) 3.5.10 3.6 up to (but not including) 3.6.7 3.7 up to (but not including) 3.7.3 3.8 up to (but not including) 3.8.3 3.9 up to (but not including) 3.9.5 4.0 up to (but not including) 4.0.4 4.1 up to (but not including) 4.1.4 4.2 up to (but not including) 4.2.5 4.3 up to (but not including) 4.3.6 4.4 up to (but not including) 4.4.4 4.5 up to (but not including) 4.5.5 4.6 up to (but not including) 4.6.5 4.7 up to (but not including) 4.7.4 4.8 up to (but not including) 4.8.3 4.9 up to (but not including) 4.9.5 5.0 up to (but not including) 5.0.3 5.1 up to (but not including) 5.1.3 5.2 up to (but not including) 5.2.5 5.3 up to (but not including) 5.3.3 5.4 up to (but not including) 5.4.4 5.5 up to (but not including) 5.5.4 5.6 up to (but not including) 5.6.2 5.7 up to (but not including) 5.7.2 5.8 up to (but not including) 5.8.1 5.9 up to (but not including) 5.9.1 6.0 up to (but not including) 6.0.1 6.1 up to (but not including) 6.1.2 6.2 up to (but not including) 6.2.2 6.3 up to (but not including) 6.3.1 |
3.5.10 |
March 10, 2022 |
| CVE-2024-35777 | Low | 0.4% | 8.9.2 and earlier | 9.0.0 |
June 27, 2024 |