Plugin security history

WooCommerce Blocks Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 4 vulnerability records associated with WooCommerce Blocks, published between 2020 and 2023.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

4Total records

0Critical

2High

2Medium

0Low

0Informational

4Patched records

0Currently marked unpatched

2020-11-05First disclosure

2023-11-15Latest disclosure

2 of 4CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2020	2	2 records
2021	1	1 records
2023	1	1 records

Severity Breakdown

Severity	Records	Share
High	2	50%
Medium	2	50%

Vulnerability-Type Breakdown

Missing Authorization

2 records50%

First: 2020. Latest: 2020.

SQL Injection

1 record25%

First: 2021. Latest: 2021.

Cross-Site Scripting

1 record25%

First: 2023. Latest: 2023.

Patch Status

Patched: 4
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

11.1.2
5.5.1
5.4.1
5.3.2
5.2.1
5.1.1
5.0.1
4.9.2
4.8.1
4.7.1
4.6.1
4.5.3
4.4.3
4.3.1
4.2.1
4.1.1
4.0.1
3.9.1
3.8.1
3.7.2
3.6.1
3.5.1
3.4.1
3.3.1
3.2.1
3.1.1
3.0.1
2.9.1
2.8.1
2.7.2
2.6.2
2.5.16
3.7.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`3.1`	WooCommerce Blocks < 5.5 - Authenticated Blind SQL Injection	July 3, 2021	2.5.16, 2.6.2, 2.7.2, 2.8.1, 2.9.1, 3.0.1, 3.1.1, 3.2.1, 3.3.1, 3.4.1, 3.5.1, 3.6.1, 3.7.2, 3.8.1, 3.9.1, 4.0.1, 4.1.1, 4.2.1, 4.3.1, 4.4.3, 4.5.3, 4.6.1, 4.7.1, 4.8.1, 4.9.2, 5.0.1, 5.1.1, 5.2.1, 5.3.2, 5.4.1, 5.5.1	High
`3.0`	WooCommerce Blocks < 5.5 - Authenticated Blind SQL Injection	July 3, 2021	2.5.16, 2.6.2, 2.7.2, 2.8.1, 2.9.1, 3.0.1, 3.1.1, 3.2.1, 3.3.1, 3.4.1, 3.5.1, 3.6.1, 3.7.2, 3.8.1, 3.9.1, 4.0.1, 4.1.1, 4.2.1, 4.3.1, 4.4.3, 4.5.3, 4.6.1, 4.7.1, 4.8.1, 4.9.2, 5.0.1, 5.1.1, 5.2.1, 5.3.2, 5.4.1, 5.5.1	High
`2.9`	WooCommerce Blocks < 5.5 - Authenticated Blind SQL Injection	July 3, 2021	2.5.16, 2.6.2, 2.7.2, 2.8.1, 2.9.1, 3.0.1, 3.1.1, 3.2.1, 3.3.1, 3.4.1, 3.5.1, 3.6.1, 3.7.2, 3.8.1, 3.9.1, 4.0.1, 4.1.1, 4.2.1, 4.3.1, 4.4.3, 4.5.3, 4.6.1, 4.7.1, 4.8.1, 4.9.2, 5.0.1, 5.1.1, 5.2.1, 5.3.2, 5.4.1, 5.5.1	High
`2.8`	WooCommerce Blocks < 5.5 - Authenticated Blind SQL Injection	July 3, 2021	2.5.16, 2.6.2, 2.7.2, 2.8.1, 2.9.1, 3.0.1, 3.1.1, 3.2.1, 3.3.1, 3.4.1, 3.5.1, 3.6.1, 3.7.2, 3.8.1, 3.9.1, 4.0.1, 4.1.1, 4.2.1, 4.3.1, 4.4.3, 4.5.3, 4.6.1, 4.7.1, 4.8.1, 4.9.2, 5.0.1, 5.1.1, 5.2.1, 5.3.2, 5.4.1, 5.5.1	High
`2.7-2.7.1`	WooCommerce Blocks < 5.5 - Authenticated Blind SQL Injection	July 3, 2021	2.5.16, 2.6.2, 2.7.2, 2.8.1, 2.9.1, 3.0.1, 3.1.1, 3.2.1, 3.3.1, 3.4.1, 3.5.1, 3.6.1, 3.7.2, 3.8.1, 3.9.1, 4.0.1, 4.1.1, 4.2.1, 4.3.1, 4.4.3, 4.5.3, 4.6.1, 4.7.1, 4.8.1, 4.9.2, 5.0.1, 5.1.1, 5.2.1, 5.3.2, 5.4.1, 5.5.1	High
`2.6-2.6.1`	WooCommerce Blocks < 5.5 - Authenticated Blind SQL Injection	July 3, 2021	2.5.16, 2.6.2, 2.7.2, 2.8.1, 2.9.1, 3.0.1, 3.1.1, 3.2.1, 3.3.1, 3.4.1, 3.5.1, 3.6.1, 3.7.2, 3.8.1, 3.9.1, 4.0.1, 4.1.1, 4.2.1, 4.3.1, 4.4.3, 4.5.3, 4.6.1, 4.7.1, 4.8.1, 4.9.2, 5.0.1, 5.1.1, 5.2.1, 5.3.2, 5.4.1, 5.5.1	High
`*-2.5.15`	WooCommerce Blocks < 5.5 - Authenticated Blind SQL Injection	July 3, 2021	2.5.16, 2.6.2, 2.7.2, 2.8.1, 2.9.1, 3.0.1, 3.1.1, 3.2.1, 3.3.1, 3.4.1, 3.5.1, 3.6.1, 3.7.2, 3.8.1, 3.9.1, 4.0.1, 4.1.1, 4.2.1, 4.3.1, 4.4.3, 4.5.3, 4.6.1, 4.7.1, 4.8.1, 4.9.2, 5.0.1, 5.1.1, 5.2.1, 5.3.2, 5.4.1, 5.5.1	High
`[*, 3.7.1)`	WooCommerce Blocks <= 3.7.0 - Authorization Bypass	November 5, 2020	3.7.1	High
`[*, 3.7.1)`	WooCommerce <= 4.6.1 & WooCommerce Blocks <= 3.7.0 - Settings Bypass leading to Account Creation	November 5, 2020	3.7.1	Medium

Selected source records

Latest Records

MediumCVE-2023-47777

WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute

Published: November 15, 2023

Affected versions: *-8.1.1
Patched versions: 8.2.0

Affected versions: *-11.1.1
Patched versions: 11.1.2

Original Wordfence record

HighCVE-2021-32789

WooCommerce Blocks < 5.5 - Authenticated Blind SQL Injection

Published: July 3, 2021

Affected versions: *-2.5.15; 2.6-2.6.1; 2.7-2.7.1; 2.8; 2.9; 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.7-3.7.1; 3.8; 3.9; 4.0; 4.1; 4.2; 4.3; 4.4-4.4.2; 4.5-4.5.2; 4.6; 4.7; 4.8; 4.9-4.9.1; 5.0; 5.1; 5.2; 5.3-5.3.1; 5.4; 5.5
Patched versions: 2.5.16, 2.6.2, 2.7.2, 2.8.1, 2.9.1, 3.0.1, 3.1.1, 3.2.1, 3.3.1, 3.4.1, 3.5.1, 3.6.1, 3.7.2, 3.8.1, 3.9.1, 4.0.1, 4.1.1, 4.2.1, 4.3.1, 4.4.3, 4.5.3, 4.6.1, 4.7.1, 4.8.1, 4.9.2, 5.0.1, 5.1.1, 5.2.1, 5.3.2, 5.4.1, 5.5.1

Original Wordfence record

Medium

WooCommerce <= 4.6.1 & WooCommerce Blocks <= 3.7.0 - Settings Bypass leading to Account Creation

Published: November 5, 2020

Affected versions: [*, 4.6.2)
Patched versions: 4.6.2

Affected versions: [*, 3.7.1)
Patched versions: 3.7.1

Original Wordfence record

High

WooCommerce Blocks <= 3.7.0 - Authorization Bypass

Published: November 5, 2020

Affected versions: [*, 3.7.1)
Patched versions: 3.7.1

Original Wordfence record

Highest-Severity Records

HighCVE-2021-32789

WooCommerce Blocks < 5.5 - Authenticated Blind SQL Injection

Published: July 3, 2021

Affected versions: *-2.5.15; 2.6-2.6.1; 2.7-2.7.1; 2.8; 2.9; 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.7-3.7.1; 3.8; 3.9; 4.0; 4.1; 4.2; 4.3; 4.4-4.4.2; 4.5-4.5.2; 4.6; 4.7; 4.8; 4.9-4.9.1; 5.0; 5.1; 5.2; 5.3-5.3.1; 5.4; 5.5
Patched versions: 2.5.16, 2.6.2, 2.7.2, 2.8.1, 2.9.1, 3.0.1, 3.1.1, 3.2.1, 3.3.1, 3.4.1, 3.5.1, 3.6.1, 3.7.2, 3.8.1, 3.9.1, 4.0.1, 4.1.1, 4.2.1, 4.3.1, 4.4.3, 4.5.3, 4.6.1, 4.7.1, 4.8.1, 4.9.2, 5.0.1, 5.1.1, 5.2.1, 5.3.2, 5.4.1, 5.5.1

Original Wordfence record

High

WooCommerce Blocks <= 3.7.0 - Authorization Bypass

Published: November 5, 2020

Affected versions: [*, 3.7.1)
Patched versions: 3.7.1

Original Wordfence record

Medium

WooCommerce <= 4.6.1 & WooCommerce Blocks <= 3.7.0 - Settings Bypass leading to Account Creation

Published: November 5, 2020

Affected versions: [*, 4.6.2)
Patched versions: 4.6.2

Affected versions: [*, 3.7.1)
Patched versions: 3.7.1

Original Wordfence record

MediumCVE-2023-47777

WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute

Published: November 15, 2023

Affected versions: *-8.1.1
Patched versions: 8.2.0

Affected versions: *-11.1.1
Patched versions: 11.1.2

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory