--- title: "Automattic WooCommerce vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/automattic/woocommerce type: product description: "Automattic WooCommerce has 19 published CVEs, 0 in CISA KEV and 6 with public exploits." updated: 2026-10-10 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Automattic WooCommerce vulnerabilities Vendor: [Automattic](https://radicalnotion.ai/vendor/automattic) - **Published CVEs:** 19 - **In CISA KEV:** 0 - **With a public exploit:** 6 - **With a patch:** 18 - **Average CVSS:** 6.2 - **First CVE:** 2017-11-29 - **Latest CVE:** 2026-10-10 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 6 | | Medium | 12 | | Low | 1 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 7 | | [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 3 | | [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 2 | | [CWE-74](https://radicalnotion.ai/cwe/cwe-74) | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 1 | | [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 1 | | [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 1 | | [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 1 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2017 | 1 | | 2018 | 0 | | 2019 | 0 | | 2020 | 0 | | 2021 | 1 | | 2022 | 0 | | 2023 | 1 | | 2024 | 7 | | 2025 | 5 | | 2026 | 4 | ## Affected versions (top 24 of 191) | Version | Kind | CVEs | | --- | --- | --- | | \< 11.0 | range | 1 | | \< 11.1.0 | range | 1 | | \< 8.6.0 | range | 1 | | \<= 10.0.2 | range | 1 | | \<= 2.8.6 | range | 1 | | \<= 3.2.6 | range | 1 | | \<= 7.8.2 | range | 1 | | \<= 8.1.1 | range | 1 | | \<= 8.2.2 | range | 1 | | \<= 8.5.2 | range | 1 | | \<= 8.9.2 | range | 1 | | \<= 9.0.2 | range | 1 | | 8.6.0 | patched | 2 | | 10.0.3 | patched | 1 | | 10.0.5 | patched | 1 | | 10.0.6 | patched | 1 | | 10.1.3 | patched | 1 | | 10.1.4 | patched | 1 | | 10.2.3 | patched | 1 | | 10.2.4 | patched | 1 | | 10.3.7 | patched | 1 | | 10.3.8 | patched | 1 | | 10.4.3 | patched | 1 | | 10.4.4 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-106608 | WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability | high | 7.2 | No | No | Yes | | CVE-2026-48888 | WordPress WooCommerce plugin \< 11.1.0 - Denial of Service Attack vulnerability | high | 7.5 | No | No | Yes | | CVE-2026-57777 | WordPress WooCommerce plugin \< 11.0 - SQL Injection vulnerability | high | 7.6 | No | No | Yes | | CVE-2026-3589 | WooCommerce \< 10.5.3 - Arbitrary Admin User Creation via CSRF | high | 7.5 | No | Yes | Yes | | CVE-2025-15033 | WooCommerce - Subscriber/Customer+ Order Data Disclosure | medium | 6.5 | No | Yes | Yes | | CVE-2023-7320 | WooCommerce \<= 7.8.2 - Sensitive Information Exposure | medium | 5.3 | No | No | Yes | | CVE-2025-49042 | WordPress WooCommerce plugin \<= 10.0.2 - Cross Site Scripting (XSS) vulnerability | medium | 5.9 | No | No | Yes | | CVE-2025-5062 | WooCommerce \<= 9.4.2 - PostMessage-Based Cross-Site Scripting | medium | 6.1 | No | No | Yes | | CVE-2025-26762 | WordPress WooCommerce plugin \<= 9.7.0 - Cross Site Scripting (XSS) vulnerability | medium | 5.9 | No | No | Yes | | CVE-2024-10486 | Google for WooCommerce \<= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File | medium | 5.3 | No | No | Yes | | CVE-2024-9944 | WooCommerce \<= 9.0.2 - Unauthenticated HTML Injection | medium | 6.1 | No | No | Yes | | CVE-2024-39666 | WordPress WooCommerce plugin \<= 9.1.2 - Cross Site Scripting (XSS) vulnerability | medium | 5.9 | No | No | Yes | | CVE-2024-35777 | WordPress WooCommerce plugin \<= 8.9.2 - Content Injection vulnerability | low | 3.5 | No | No | Yes | | CVE-2024-1310 | WooCommerce \< 8.6 - Contributor+ Private/Draft Products Access | medium | 4.9 | No | Yes | Yes | | CVE-2024-22155 | WordPress WooCommerce plugin \<= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability | medium | 4.3 | No | No | Yes | | CVE-2023-52222 | WordPress WooCommerce Plugin \<= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) | high | 8.8 | No | No | Yes | | CVE-2023-47777 | WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability | medium | 6.5 | No | Yes | Yes | | CVE-2021-24323 | Woocommerce \< 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS) | medium | 4.8 | No | Yes | Yes | | CVE-2017-17058 | - | high | 7.5 | No | Yes | No | ## Frequently asked questions ### How many CVEs does Automattic WooCommerce have? Automattic WooCommerce has 19 published CVE records since 2017. ### How many Automattic WooCommerce CVEs are in CISA KEV? None of Automattic WooCommerce's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Automattic WooCommerce vulnerabilities? Yes — 6 of Automattic WooCommerce's CVEs have a known public exploit. ### Which versions of Automattic WooCommerce are affected? 191 distinct Automattic WooCommerce versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Automattic WooCommerce CVEs? Automattic WooCommerce's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). ### What is the average severity of Automattic WooCommerce CVEs? The average CVSS base score across Automattic WooCommerce's scored CVEs is 6.2. ## Other products from this vendor - [Jetpack](https://radicalnotion.ai/vendor/automattic/jetpack) (20 CVEs) - [Sensei LMS](https://radicalnotion.ai/vendor/automattic/sensei-lms) (10 CVEs) - [mongoose](https://radicalnotion.ai/vendor/automattic/mongoose) (8 CVEs) - [activitypub](https://radicalnotion.ai/vendor/automattic/activitypub) (6 CVEs) - [sensei](https://radicalnotion.ai/vendor/automattic/sensei) (6 CVEs) - [WordPress](https://radicalnotion.ai/vendor/automattic/wordpress) (6 CVEs) - [WP Super Cache](https://radicalnotion.ai/vendor/automattic/wp-super-cache) (6 CVEs) - [Jetpack CRM](https://radicalnotion.ai/vendor/automattic/jetpack-crm) (5 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/automattic/woocommerce). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.