automattic woocommerce vulnerabilities in 2025, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 6.5CVE-2025-15033EPSS 0.3%2025-12-22

   A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected ver…

2. 5.3CVE-2023-7320EPSS 0.3%2025-10-29

   The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on the Store API's REST endpoints allowing direct external access from any origin. …

3. 5.9CVE-2025-49042EPSS 0.2%2025-10-29

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 10.0.2.

4. 5.9CVE-2025-26762EPSS 0.2%2025-03-27

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 9.7.0.