WooCommerce vulnerabilities
Plugin slug woocommerce · 47 known vulnerabilities · latest disclosed 2026-10-08 · WordPress.org page
Every listed vulnerability has a fix. Version 11.2.0 or later is not affected by any of them. If your site runs an older version, update it.
11 of 47 rated high or critical (CVSS 7 or more).
Known vulnerabilities in WooCommerce
| Severity | Affected versions | Fixed in | CVE | Published | Details |
|---|---|---|---|---|---|
| Medium 4.7 | 9.8.0 to 11.1.2 | 11.2.0 | CVE-2026-106608 | 2026-10-08 | Advisory |
| High 7.5 | < 11.1.0 | 11.1.0 | CVE-2026-48888 | 2026-09-07 | Advisory |
| Medium 4.9 | <= 10.9.4 | 11.0 | CVE-2026-57777 | 2026-09-04 | Advisory |
| Medium 4.3 | < 10.5.3 | 10.5.3 | CVE-2026-3589 | 2026-03-10 | Advisory |
| Medium 4.3 | 10.0 to 10.0.4, 10.1 to 10.1.2, 10.2 to 10.2.2, 10.3 to 10.3.6, 8.1 to 8.1.2, 8.2 to 8.2.3, 8.3 to 8.3.2, 8.4 to 8.4.1, 8.5 to 8.5.3, 8.6 to 8.6.2, 8.7 to 8.7.1, 8.8 to 8.8.5, 8.9 to 8.9.3, 9.0 to 9.0.2, 9.1 to 9.1.4, 9.2 to 9.2.3, 9.3 to 9.3.4, 9.4 to 9.4.3, 9.5 to 9.5.2, 9.6 to 9.6.2, 9.7 to 9.7.1, 9.8 to 9.8.5, 9.9 to 9.9.5 | 8.1.3 | CVE-2025-15033 | 2025-12-22 | Advisory |
| Medium 4.4 | <= 10.0.2 | 10.0.3 | CVE-2025-49042 | 2025-10-29 | Advisory |
| Medium 6.1 | <= 9.3.2, 9.4 to 9.4.2 | 9.3.4 | CVE-2025-5062 | 2025-05-21 | Advisory |
| Medium 4.4 | <= 9.7.0 | 9.7.1 | CVE-2025-26762 | 2025-03-12 | Advisory |
| Medium 5.3 | <= 9.0.2 | 9.1.0 | CVE-2024-9944 | 2024-10-14 | Advisory |
| Medium 4.4 | <= 9.1.2 | 9.1.3 | CVE-2024-39666 | 2024-08-16 | Advisory |
| Low 2.7 | <= 8.9.2 | 9.0.0 | CVE-2024-35777 | 2024-06-27 | Advisory |
| Medium 6.1 | 8.8.0 to 8.8.4, 8.9.0 to 8.9.2 | 8.8.5 | CVE-2024-37297 | 2024-06-10 | Advisory |
| Medium 4.3 | <= 8.5.2 | 8.6.0 | CVE-2024-22155 | 2024-04-05 | Advisory |
| Medium 6.1 | < 8.4.0 | 8.4.0 | none | 2024-01-12 | Advisory |
| Medium 4.3 | <= 8.2.2 | 8.3.0 | CVE-2023-52222 | 2024-01-05 | Advisory |
| Medium 6.4 | <= 8.1.1 | 8.2.0 | CVE-2023-47777 | 2023-11-15 | Advisory |
| Medium 5.3 | <= 7.8.2 | 7.9.0 | CVE-2023-7320 | 2023-09-11 | Advisory |
| Medium 4.9 | <= 7.0.0 | 7.0.1 | none | 2023-09-11 | Advisory |
| Medium 5.5 | < 6.6.0 | 6.6.0 | CVE-2022-2099 | 2022-06-20 | Advisory |
| Medium 6.5 | < 4.0, 4.0 to 4.0.3, 4.1 to 4.1.3, 4.2 to 4.2.4, 4.3 to 4.3.5, 4.4 to 4.4.3, 4.5 to 4.5.4, 4.6 to 4.6.4, 4.7 to 4.7.3, 4.8 to 4.8.2, 4.9 to 4.9.4, 5.0 to 5.0.2, 5.1 to 5.1.2, 5.2 to 5.2.4, 5.3 to 5.3.2, 5.4 to 5.4.3, 5.5 to 5.5.3, 5.6 to 5.6.1 | 4.0.3 | none | 2022-04-10 | Advisory |
| Medium 4.3 | 3.5 to 3.5.10, 3.6 to 3.6.7, 3.7 to 3.7.3, 3.8 to 3.8.3, 3.9 to 3.9.5, 4.0 to 4.0.4, 4.1 to 4.1.4, 4.2 to 4.2.5, 4.3 to 4.3.6, 4.4 to 4.4.4, 4.5 to 4.5.5, 4.6 to 4.6.5, 4.7 to 4.7.4, 4.8 to 4.8.3, 4.9 to 4.9.5, 5.0 to 5.0.3, 5.1 to 5.1.3, 5.2 to 5.2.5, 5.3 to 5.3.3, 5.4 to 5.4.4, 5.5 to 5.5.4, 5.6 to 5.6.2, 5.7 to 5.7.2, 5.8 to 5.8.1, 5.9 to 5.9.1, 6.0 to 6.0.1, 6.1 to 6.1.2, 6.2 to 6.2.2, 6.3 to 6.3.1 | 3.5.10 | none | 2022-03-10 | Advisory |
| Medium 5.4 | <= 6.2.0 | 6.2.1 | CVE-2022-0775 | 2022-02-22 | Advisory |
| High 7.2 | <= 6.2.0 | 6.2.1 | none | 2022-02-22 | Advisory |
| High 8.8 | < 3.3, 3.3 to 3.3.5, 3.4 to 3.4.7, 3.5 to 3.5.8, 3.6 to 3.6.5, 3.7 to 3.7.1, 3.8 to 3.8.1, 3.9 to 3.9.3, 4.0 to 4.0.1, 4.1 to 4.1.1, 4.2 to 4.2.2, 4.3 to 4.3.3, 4.4 to 4.4.1, 4.5 to 4.5.2, 4.6 to 4.6.2, 4.7 to 4.7.1, 4.8, 4.9 to 4.9.2, 5.0, 5.1, 5.2 to 5.2.2, 5.3, 5.4 to 5.4.1, 5.5 | 3.3.6 | CVE-2021-32790 | 2021-07-13 | Advisory |
| Medium 4.8 | < 5.2.0 | 5.2.0 | CVE-2021-24323 | 2021-04-21 | Advisory |
| Medium 6.5 | < 4.6.2 | 4.6.2 | none | 2020-11-05 | Advisory |
| Medium 6.1 | < 4.2.1 | 4.2.1 | none | 2020-06-22 | Advisory |
| High 8.8 | < 4.1.0 | 4.1.0 | none | 2020-05-05 | Advisory |
| Medium 5.3 | < 4.7.0 | 4.7.0 | CVE-2020-29156 | 2020-01-21 | Advisory |
| High 7.2 | <= 3.6.4 | 3.6.5 | none | 2019-07-02 | Advisory |
| High 8.8 | < 3.6.5 | 3.6.5 | none | 2019-07-02 | Advisory |
| Medium 6.1 | < 3.5.5 | 3.5.5 | CVE-2019-9168 | 2019-02-20 | Advisory |
| Medium 5.5 | <= 3.5.1 | 3.5.2 | none | 2018-11-29 | Advisory |
| High 7.2 | < 3.4.6 | 3.4.6 | CVE-2018-20714 | 2018-11-06 | Advisory |
| Medium 6.6 | < 3.4.5 | 3.4.5 | none | 2018-08-29 | Advisory |
| High 8.8 | < 3.2.4 | 3.2.4 | CVE-2017-18356 | 2017-11-16 | Advisory |
| Medium 5.5 | < 2.6.9 | 2.6.9 | CVE-2016-10112 | 2016-12-07 | Advisory |
| Medium 6.4 | < 2.6.4 | 2.6.4 | none | 2016-07-26 | Advisory |
| Medium 6.4 | < 2.6.3 | 2.6.3 | none | 2016-07-19 | Advisory |
| Medium 5.5 | < 2.4.9 | 2.4.9 | none | 2015-11-17 | Advisory |
| High 7.5 | <= 2.3.10 | 2.3.11 | none | 2015-06-10 | Advisory |
| High 7.2 | < 2.3.6 | 2.3.6 | CVE-2015-2329 | 2015-03-13 | Advisory |
| Medium 6.1 | < 2.2.11 | 2.2.11 | CVE-2015-2069 | 2015-01-29 | Advisory |
| Medium 6.1 | < 2.2.3 | 2.2.3 | none | 2014-09-17 | Advisory |
| High 7.3 | < 2.2.3 | 2.2.3 | CVE-2014-6313 | 2014-09-15 | Advisory |
| Medium 6.1 | <= 2.0.17 | 2.0.18 | none | 2013-10-17 | Advisory |
| Medium 6.1 | <= 2.0.12 | 2.0.13 | none | 2013-07-18 | Advisory |
Check if a site is affected
Enter a site address to see which version of WooCommerce and other plugins it runs, and whether they match a known vulnerability.
Questions
Is the WooCommerce plugin safe to use?
All 47 known issues are fixed in current versions (11.2.0 or later). Keeping it updated is what matters.
How do I check which version of WooCommerce my site runs?
In WordPress go to Plugins > Installed Plugins. From the outside, the free PluginPeek scan below reads the version from the site's public files.
How do I fix a vulnerable plugin?
Make a full backup, then update it from Dashboard > Updates and check the site afterwards. If you would rather not, we can do it for a fixed $99, paid after you have checked the site.
Check any WordPress site in one click while you browse: Add PluginPeek to Chrome