Woo vulnerabilities

Products

• product vendors 4
• WooCommerce Warranty Requests 3
• WooCommerce Product Vendors 2
• WooCommerce Ship to Multiple Addresses 2
• AutomateWoo 1
• WooCommerce Box Office 1
• WooCommerce Canada Post Shipping 1
• WooCommerce Subscriptions 1

Latest Woo CVEs

Newest publication first

1. CVE-2023-50850 WordPress Woo Subscriptions plugin < 5.8.0 - Broken Access Control vulnerability

   Published 2024-12-31

   Medium·CVSS 4.3 EPSS 0.38%

   Missing Authorization vulnerability in Woo WooCommerce Subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Subscriptions: from n/a before 5.8.0.

2. CVE-2017-20193 Product Vendors <= 2.0.35 - Reflected Cross Site Scripting

   Published 2024-10-16

   Medium·CVSS 6.1 EPSS 0.42%

   The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

3. CVE-2023-37872 WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.5 - Broken Access Control vulnerability

   Published 2024-06-19

   Medium·CVSS 6.5 EPSS 0.49%

   Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.5.

4. CVE-2023-36512 WordPress AutomateWoo plugin <= 5.7.5 - Broken Access Control vulnerability

   Published 2024-06-19

   Medium·CVSS 6.5 EPSS 0.39%

   Missing Authorization vulnerability in Woo AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.5.

5. CVE-2023-37870 WordPress WooCommerce Warranty Requests plugin <= 2.1.9 - Broken Access Control vulnerability

   Published 2024-06-19

   High·CVSS 8.1 EPSS 0.43%

   Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.1.9.

6. CVE-2023-51495 WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability

   Published 2024-06-14

   Medium·CVSS 6.5 EPSS 0.36%

   Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.

7. CVE-2023-51496 WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerability

   Published 2024-06-14

   Medium·CVSS 5.3 EPSS 0.31%

   Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.

8. CVE-2023-51497 WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.9 - Broken Access Control vulnerability

   Published 2024-06-14

   Medium·CVSS 5.4 EPSS 0.31%

   Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.9.

9. CVE-2023-51498 WordPress WooCommerce Canada Post Shipping plugin <= 2.8.3 - Broken Access Control vulnerability

   Published 2024-06-11

   Medium·CVSS 5.3 EPSS 0.38%

   Missing Authorization vulnerability in Woo WooCommerce Canada Post Shipping.This issue affects WooCommerce Canada Post Shipping: from n/a through 2.8.3.

10. CVE-2023-52186 WordPress WooCommerce Product Vendors plugin <= 2.2.2 - Unauthenticated Broken Access Control vulnerability

    Published 2024-06-11

    Medium·CVSS 5.3 EPSS 0.31%

    Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.2.

11. CVE-2023-34003 WordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerability

    Published 2024-06-09

    Medium·CVSS 5.3 EPSS 0.35%

    Missing Authorization vulnerability in Woo WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.1.51.

12. CVE-2023-51494 WordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerability

    Published 2024-06-09

    Critical·CVSS 9.8 EPSS 0.37%

    Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.1.

13. CVE-2023-33331 WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to SQL Injection

    Published 2023-12-18

    High·CVSS 7.2 EPSS 0.93%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.76.

14. CVE-2023-35879 WordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL Injection

    Published 2023-10-31

    Critical·CVSS 9.8 EPSS 0.73%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.