WooCommerce vulnerabilities

Known security issues in the WooCommerce WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: woocommerce
Latest version: 11.2.1
Active installs: 7,000,000+
Known vulnerabilities: 99 (1 without a fix)
Data updated: 2026-10-16 19:06 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

No fix available (1)

The source lists no fixed version. Consider deactivating and replacing the plugin until a fix is released.

WooCommerce: No fix available
Vulnerability	Severity	CVSS	Affected versions	Published
[en] WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. CVE-2022-50972 · Source	Critical	9.8	= 7.1.0	2026-06-20

Fixed in version 11.2.0 (1)

WooCommerce: Fixed in version 11.2.0
Vulnerability	Severity	CVSS	Affected versions	Published
[en] Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2. CVE-2026-106608 · Source	High	7.2	>= 9.8.0 and < 11.2.0	2026-10-10

Fixed in version 11.1.0 (1)

WooCommerce: Fixed in version 11.1.0
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce < 11.1.0 - Unauthenticated Denial of Service CVE-2026-48888 · Source	High	7.5	< 11.1.0	2026-09-04

Fixed in version 11.0 (1)

WooCommerce: Fixed in version 11.0
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 10.9.4 - Authenticated (Shop Manager+) SQL Injection CVE-2026-57777 · Source	High	7.6	< 11.0	2026-09-04

Fixed in version 10.5.3 (1)

WooCommerce: Fixed in version 10.5.3
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF CVE-2026-3589 · Source	Not rated	-	< 10.5.3	0000-00-00

Fixed in version 10.4.3 (1)

WooCommerce: Fixed in version 10.4.3
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 10.4.2 - Authenticated (Subscriber+) Information Exposure CVE-2025-15033 · Source	Medium	6.5	< 10.4.3	2025-12-22

Fixed in version 10.0.3 (1)

WooCommerce: Fixed in version 10.0.3
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting CVE-2025-49042 · Source	Low	0.0	< 10.0.3	2025-10-29

Fixed in version 9.7.1 (1)

WooCommerce: Fixed in version 9.7.1
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting CVE-2025-26762 · Source	Medium	5.9	< 9.7.1	2025-03-12

Fixed in version 9.4.3 (1)

WooCommerce: Fixed in version 9.4.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin < 9.4.3 is vulnerable to Broken Access Control No CVE assigned · Source	Not rated	-	< 9.4.3	2024-12-04

Fixed in version 9.3.4 (1)

WooCommerce: Fixed in version 9.3.4
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting CVE-2025-5062 · Source	Medium	6.1	< 9.3.4	0000-00-00

Fixed in version 9.1.3 (1)

WooCommerce: Fixed in version 9.1.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 9.1.2 is vulnerable to Cross Site Scripting (XSS) CVE-2024-39666 · Source	Medium	5.9	< 9.1.3	2024-08-16

Fixed in version 9.1.0 (1)

WooCommerce: Fixed in version 9.1.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 9.0.2 is vulnerable to Content Injection CVE-2024-9944 · Source	Medium	6.1	< 9.1.0	2024-10-14

Fixed in version 9.0.0 (1)

WooCommerce: Fixed in version 9.0.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 8.9.2 is vulnerable to Content Injection CVE-2024-35777 · Source	Low	3.5	< 9.0.0	2024-06-27

Fixed in version 8.9.3 (2)

WooCommerce: Fixed in version 8.9.3
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce 8.8.0 - 8.9.2 - Reflected Cross-Site Scripting via Order Attribution CVE-2024-37297 · Source	Medium	5.4	< 8.9.3	2024-06-10
WordPress WooCommerce Plugin <= 8.9.2 is vulnerable to Cross Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 8.9.3	2024-06-11

Fixed in version 8.6.0 (1)

WooCommerce: Fixed in version 8.6.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2024-22155 · Source	Medium	4.3	< 8.6.0	2024-04-05

Fixed in version 8.6 (1)

WooCommerce: Fixed in version 8.6
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin < 8.6 is vulnerable to Broken Access Control CVE-2024-1310 · Source	Medium	4.9	< 8.6	2024-03-25

Fixed in version 8.4.0 (3)

WooCommerce: Fixed in version 8.4.0
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce < 8.4.0 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 8.4.0	2024-01-12
WordPress WooCommerce Plugin <= 8.3.0 is vulnerable to Cross Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 8.4.0	-
WooCommerce < 8.4.0 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 8.4.0	-

Fixed in version 8.3.0 (1)

WooCommerce: Fixed in version 8.3.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-52222 · Source	Medium	4.3	< 8.3.0	2024-01-05

Fixed in version 8.2.0 (1)

WooCommerce: Fixed in version 8.2.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 8.1.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-47777 · Source	Medium	6.5	< 8.2.0	2023-11-15

Fixed in version 7.9.0 (2)

WooCommerce: Fixed in version 7.9.0
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 7.8.2 - Sensitive Information Exposure No CVE assigned · Source	Not rated	-	< 7.9.0	2023-09-11
WooCommerce < 7.9.0 - Sensitive Information Exposure No CVE assigned · Source	Not rated	-	< 7.9.0	-

Fixed in version 7.9 (1)

WooCommerce: Fixed in version 7.9
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce < 7.9 - Unauthenticated Sensitive Information Disclosure No CVE assigned · Source	Not rated	-	< 7.9	-

Fixed in version 7.0.1 (3)

WooCommerce: Fixed in version 7.0.1
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 7.0.0 - Authenticated(Shop Manager+) Sensitive Information Exposure No CVE assigned · Source	Not rated	-	< 7.0.1	2023-09-11
WooCommerce < 7.0.1 - Shop Manager+ User Metadata Disclosure No CVE assigned · Source	Not rated	-	< 7.0.1	-
WooCommerce < 7.0.1 - Authenticated(Shop Manager+) Sensitive Information Exposure No CVE assigned · Source	Not rated	-	< 7.0.1	-

Fixed in version 6.6.0 (2)

WooCommerce: Fixed in version 6.6.0
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce < 5.5 - Authenticated Blind SQL Injection CVE-2021-32790 · Source	Medium	4.9	< 6.6.0	2021-07-13
WordPress WooCommerce plugin <= 6.5.1 - Authenticated Stored HTML Injection vulnerability CVE-2022-2099 · Source	Medium	4.8	< 6.6.0	2022-06-20

Fixed in version 6.3.1 (2)

WooCommerce: Fixed in version 6.3.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce plugin <= 6.3.0 - Orders Status Change (via PayPal Standard Gateway) vulnerability No CVE assigned · Source	Not rated	-	< 6.3.1	2022-03-10
WooCommerce < 6.3.1 - Unauthorized Order Status Change No CVE assigned · Source	Not rated	-	< 6.3.1	2022-03-10

Fixed in version 6.2.1 (5)

WooCommerce: Fixed in version 6.2.1
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 6.2.0 - Incorrect Authorization Checks on REST API Endpoints CVE-2022-0775 · Source	Medium	4.3	< 6.2.1	2022-02-22
WordPress WooCommerce plugin <= 6.2.0 - Path Traversal via Importers vulnerability No CVE assigned · Source	Not rated	-	< 6.2.1	2022-02-23
WordPress WooCommerce plugin <= 6.2.0 - Arbitrary Comment Deletion vulnerability No CVE assigned · Source	Not rated	-	< 6.2.1	2022-02-23
WooCommerce <= 6.2.0 - Path Traversal via Tax Importer No CVE assigned · Source	Not rated	-	< 6.2.1	2022-02-22
WooCommerce < 6.3.1 - Orders Marked as Paid (via PayPal Standard Gateway) No CVE assigned · Source	Not rated	-	< 6.2.1	-

Fixed in version 5.7.0 (4)

WooCommerce: Fixed in version 5.7.0
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Information Disclosure No CVE assigned · Source	Not rated	-	< 5.7.0	2022-04-10
WordPress WooCommerce plugin <= 5.6.0 - Analytics Report Leaks vulnerability No CVE assigned · Source	Not rated	-	< 5.7.0	2021-09-22
WooCommerce < 6.2.1 - Path Traversal via Importers No CVE assigned · Source	Not rated	-	< 5.7.0	-
WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Analytics Report Leaks No CVE assigned · Source	Not rated	-	< 5.7.0	-

Fixed in version 5.5.1 (1)

WooCommerce: Fixed in version 5.5.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce plugin <= 5.5.0 - Unauthenticated SQL Injection (SQLi) vulnerability No CVE assigned · Source	Not rated	-	< 5.5.1	2021-07-15

Fixed in version 5.2.0 (2)

WooCommerce: Fixed in version 5.2.0
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 5.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2021-24323 · Source	Medium	4.8	< 5.2.0	2021-04-21
WordPress WooCommerce plugin <= 5.1.0 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 5.2.0	2021-04-29

Fixed in version 4.7.0 (1)

WooCommerce: Fixed in version 4.7.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce plugin <= 4.6.2 - Sensitive Information Disclosure vulnerability CVE-2020-29156 · Source	Medium	5.3	< 4.7.0	2020-01-21

Fixed in version 4.6.2 (3)

WooCommerce: Fixed in version 4.6.2
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce plugin <= 4.6.1 - Guest Account Creation vulnerability No CVE assigned · Source	Not rated	-	< 4.6.2	2020-11-06
WooCommerce <= 4.6.1 & WooCommerce Blocks <= 3.7.0 - Settings Bypass leading to Account Creation No CVE assigned · Source	Not rated	-	< 4.6.2	2020-11-05
WooCommerce < 4.6.2 - Guest Account Creation No CVE assigned · Source	Not rated	-	< 4.6.2	-

Fixed in version 4.2.1 (2)

WooCommerce: Fixed in version 4.2.1
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 4.2.0 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 4.2.1	2020-06-22
WooCommerce < 4.2.1 - Potential Cross-Site Scripting (XSS) via SelectWoo No CVE assigned · Source	Not rated	-	< 4.2.1	-

Fixed in version 4.1.0 (2)

WooCommerce: Fixed in version 4.1.0
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification No CVE assigned · Source	Not rated	-	< 4.1.0	2020-05-05
WooCommerce < 4.1.0 - Unescaped Metadata when Duplicating Products No CVE assigned · Source	Not rated	-	< 4.1.0	-

Fixed in version 4.0 (1)

WooCommerce: Fixed in version 4.0
Vulnerability	Severity	CVSS	Affected versions	Published
[en] The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which accesses a parent directory. CVE-2017-17058 · Source	High	7.5	< 4.0	2017-11-29

Fixed in version 3.6.5 (4)

WooCommerce: Fixed in version 3.6.5
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce plugin <= 3.6.4 - Cross-Site Request Forgery (CSRF) vulnerability No CVE assigned · Source	Not rated	-	< 3.6.5	2019-07-07
WooCommerce <= 3.6.4 - Missing File Type Validation No CVE assigned · Source	Not rated	-	< 3.6.5	2019-07-02
WooCommerce <= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.6.5	2019-07-02
WooCommerce <= 3.6.4 - Cross-Site Request Forgery (CSRF) & File Type Check No CVE assigned · Source	Not rated	-	< 3.6.5	-

Fixed in version 3.5.5 (1)

WooCommerce: Fixed in version 3.5.5
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce plugin <= 3.5.4 - Stored Cross-Site Scripting (XSS) vulnerability CVE-2019-9168 · Source	Medium	6.1	< 3.5.5	2019-02-20

Fixed in version 3.5.2 (1)

WooCommerce: Fixed in version 3.5.2
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 3.5.1 - Authenticated Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.5.2	2018-11-29

Fixed in version 3.5.1 (2)

WooCommerce: Fixed in version 3.5.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce plugin <= 3.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 3.5.1	2019-01-07
WooCommerce <= 3.5.0 - Authenticated Stored XSS No CVE assigned · Source	Not rated	-	< 3.5.1	-

Fixed in version 3.4.6 (7)

WooCommerce: Fixed in version 3.4.6
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 3.4.5 - WooCommerce File Deletion CVE-2018-20714 · Source	High	8.1	< 3.4.6	2018-11-06
WordPress WooCommerce plugin <= 3.4.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 3.4.6	2018-12-11
WordPress WooCommerce plugin <= 3.4.5 - Authenticated File Deletion to Privilege Escalation vulnerability No CVE assigned · Source	Not rated	-	< 3.4.6	2018-11-07
WordPress WooCommerce plugin <= 3.4.5 - Authenticated Object Injection vulnerability No CVE assigned · Source	Not rated	-	< 3.4.6	2018-10-29
WooCommerce <= 3.4.5 - Authenticated Phar Deserialization No CVE assigned · Source	Not rated	-	< 3.4.6	-
WooCommerce <= 3.4.5 - Authenticated Stored XSS No CVE assigned · Source	Not rated	-	< 3.4.6	-
WooCommerce <= 3.4.5 - Authenticated Object Injection No CVE assigned · Source	Not rated	-	< 3.4.6	-

Fixed in version 3.4.5 (3)

WooCommerce: Fixed in version 3.4.5
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce plugin <= 3.4.4 - Potential Object Injection vulnerability No CVE assigned · Source	Not rated	-	< 3.4.5	2018-09-01
WooCommerce <= 3.4.4 - Authenticated PHP Object Injection No CVE assigned · Source	Not rated	-	< 3.4.5	2018-08-29
WooCommerce <= 3.4.4 - Potential Object Injection No CVE assigned · Source	Not rated	-	< 3.4.5	-

Fixed in version 3.2.4 (2)

WooCommerce: Fixed in version 3.2.4
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 3.2.3 - Authenticated PHP Object Injection CVE-2017-18356 · Source	High	8.8	< 3.2.4	2017-11-16
WordPress WooCommerce plugin <=3.2.3 - Authenticated PHP Object Injection vulnerability No CVE assigned · Source	Not rated	-	< 3.2.4	2018-02-23

Fixed in version 2.6.9 (1)

WooCommerce: Fixed in version 2.6.9
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 2.6.8 - Cross Site Scripting CVE-2016-10112 · Source	Medium	4.8	< 2.6.9	2016-12-07

Fixed in version 2.6.4 (3)

WooCommerce: Fixed in version 2.6.4
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 2.6.3 - Cross Site Scripting No CVE assigned · Source	Not rated	-	< 2.6.4	2016-09-09
WooCommerce <= 2.6.3 - Stored Cross-Site Scripting via REST-API No CVE assigned · Source	Not rated	-	< 2.6.4	2016-07-26
WooCommerce <= 2.6.3 - Stored Cross Site Scripting (XSS) via REST API No CVE assigned · Source	Not rated	-	< 2.6.4	-

Fixed in version 2.6.3 (3)

WooCommerce: Fixed in version 2.6.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 2.6.2 - Cross Site Scripting No CVE assigned · Source	Not rated	-	< 2.6.3	2016-07-20
WooCommerce <= 2.6.2 - Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.6.3	2016-07-19
WooCommerce <= 2.6.2 - Authenticated Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 2.6.3	-

Fixed in version 2.4.9 (3)

WooCommerce: Fixed in version 2.4.9
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 2.4.8 - Cross Site Scripting No CVE assigned · Source	Not rated	-	< 2.4.9	2015-11-17
WooCommerce < 2.4.9 - Cross-site Scripting No CVE assigned · Source	Not rated	-	< 2.4.9	2015-11-17
WooCommerce <= 2.4.8 - Authenticated Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 2.4.9	-

Fixed in version 2.3.11 (2)

WooCommerce: Fixed in version 2.3.11
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 2.3.10 - XXE No CVE assigned · Source	Not rated	-	< 2.3.11	2015-06-17
WooCommerce 2.0.20-2.3.10 - Object Injection / XXE No CVE assigned · Source	Not rated	-	< 2.3.11	-

Fixed in version 2.3.6 (1)

WooCommerce: Fixed in version 2.3.6
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 2.3.5 - SQL Injection No CVE assigned · Source	Not rated	-	< 2.3.6	2015-05-15

Fixed in version 2.2.11 (1)

WooCommerce: Fixed in version 2.2.11
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 2.2.10 - XSS CVE-2015-2069 · Source	Low	0.0	< 2.2.11	2015-01-29

Fixed in version 2.2.3 (4)

WooCommerce: Fixed in version 2.2.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 2.1.12 - Reflected XSS No CVE assigned · Source	Not rated	-	< 2.2.3	2015-06-10
WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.2.3	2014-09-17
WordPress WooCommerce plugin <= 2.2.2 - Cross-Site Scripting (XSS) vulnerability CVE-2014-6313 · Source	Low	0.0	< 2.2.3	2014-09-11
WooCommerce <= 2.1.12 - Reflected Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 2.2.3	-

Fixed in version 2.0.18 (2)

WooCommerce: Fixed in version 2.0.18
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 2.0.17 - Reflected Cross Site Scripting No CVE assigned · Source	Not rated	-	< 2.0.18	2015-05-15
WooCommerce <= 2.0.17 - Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.0.18	2013-10-17

Fixed in version 2.0.17 (1)

WooCommerce: Fixed in version 2.0.17
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce 2.0.17 - hide-wc-extensions-message Parameter Reflected XSS No CVE assigned · Source	Not rated	-	< 2.0.17	-

Fixed in version 2.0.13 (3)

WooCommerce: Fixed in version 2.0.13
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress WooCommerce Plugin <= 2.0.12 - Cross Site Scripting No CVE assigned · Source	Not rated	-	< 2.0.13	2015-05-15
WooCommerce <= 2.0.12 - Self-Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.0.13	2013-07-18
WooCommerce 2.0.12 - index.php calc_shipping_state Parameter XSS No CVE assigned · Source	Not rated	-	< 2.0.13	-

Affects version 2.3.10 and earlier (1)

The source does not state the fixed version; versions after this one are not listed as affected.

WooCommerce: Affects version 2.3.10 and earlier
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 2.3.10 - PHP Object Injection No CVE assigned · Source	Not rated	-	>= 2.0.20 and <= 2.3.10	2015-06-10

Affects version 2.3.5 and earlier (1)

The source does not state the fixed version; versions after this one are not listed as affected.

WooCommerce: Affects version 2.3.5 and earlier
Vulnerability	Severity	CVSS	Affected versions	Published
WooCommerce <= 2.3.5 - Stored Cross-Site Scripting CVE-2015-2329 · Source	Medium	6.1	>= 2.3 and <= 2.3.5	2015-03-13

Check every plugin on your site automatically

Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.