Plugin security history

WooCommerce Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 44 vulnerability records associated with WooCommerce, published between 2013 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

44Total records

0Critical

10High

33Medium

1Low

0Informational

44Patched records

0Currently marked unpatched

2013-07-18First disclosure

2026-03-10Latest disclosure

25 of 44CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2013	2	2 records
2014	2	2 records
2015	4	4 records
2016	3	3 records
2017	1	1 records
2018	3	3 records
2019	3	3 records
2020	4	4 records
2021	2	2 records
2022	5	5 records
2023	3	3 records
2024	7	7 records
2025	4	4 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
High	10	22.7%
Medium	33	75%
Low	1	2.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

23 records52.3%

First: 2013. Latest: 2025.

Other

4 records9.1%

First: 2015. Latest: 2024.

CSRF

4 records9.1%

First: 2019. Latest: 2026.

Missing Authorization

4 records9.1%

First: 2020. Latest: 2022.

Information Disclosure

4 records9.1%

First: 2022. Latest: 2025.

Path Traversal

2 records4.5%

First: 2018. Latest: 2022.

SQL Injection

2 records4.5%

First: 2020. Latest: 2021.

Arbitrary File Upload

1 record2.3%

First: 2019. Latest: 2019.

Patch Status

Patched: 44
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

10.5.3
9.9.6
9.8.6
9.7.2
9.6.3
9.5.3
9.4.4
9.3.5
9.2.4
9.1.5
9.0.3
8.9.4
8.8.6
8.7.2
8.6.3
8.5.4
8.4.2
8.3.3
8.2.4
8.1.3
10.3.7
10.2.3
10.1.3
10.0.5
10.0.3
9.4.3
9.3.4
9.7.1
9.1.0
9.1.3
9.0.0
8.9.3
8.8.5
8.6.0
8.4.0
8.3.0
8.2.0
7.0.1
7.9.0
6.6.0
5.7.0
5.6.1
5.5.3
5.4.3
5.3.2
5.2.4
5.1.2
5.0.2
4.9.4
4.8.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`[*, 2.6.9)`	WooCommerce <= 2.6.8 - Authenticated Stored Cross-Site Scripting	December 7, 2016	2.6.9	Medium
`[*, 2.6.4)`	WooCommerce <= 2.6.3 - Stored Cross-Site Scripting via REST-API	July 26, 2016	2.6.4	Medium
`[*, 2.6.3)`	WooCommerce <= 2.6.2 - Stored Cross-Site Scripting	July 19, 2016	2.6.3	Medium
`[*, 2.4.9)`	WooCommerce < 2.4.9 - Cross-site Scripting	November 17, 2015	2.4.9	Medium
`*-2.3.10`	WooCommerce <= 2.3.10 - PHP Object Injection	June 10, 2015	2.3.11	High
`[*, 2.3.6)`	WooCommerce <= 2.3.5 - Stored Cross-Site Scripting	March 13, 2015	2.3.6	High
`[*, 2.2.11)`	WooCommerce <= 2.2.10 - Cross-Site Scripting	January 29, 2015	2.2.11	Medium
`[*, 2.2.3)`	WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting	September 17, 2014	2.2.3	Medium
`[*, 2.2.3)`	WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter	September 15, 2014	2.2.3	High
`*-2.0.17`	WooCommerce <= 2.0.17 - Cross-Site Scripting	October 17, 2013	2.0.18	Medium
`*-2.0.12`	WooCommerce <= 2.0.12 - Self-Reflected Cross-Site Scripting	July 18, 2013	2.0.13	Medium

Selected source records

Latest Records

MediumCVE-2026-3589

WooCommerce < 10.5.3 - Cross-Site Request Forgery

Published: March 10, 2026

Affected versions: [*, 10.5.3)
Patched versions: 10.5.3

Original Wordfence record

MediumCVE-2025-15033

WooCommerce <= 10.4.2 - Authenticated (Subscriber+) Information Exposure

Published: December 22, 2025

Affected versions: 10.0-10.0.4; 10.1-10.1.2; 10.2-10.2.2; 10.3-10.3.6; 8.1-8.1.2; 8.2-8.2.3; 8.3-8.3.2; 8.4-8.4.1; 8.5-8.5.3; 8.6-8.6.2; 8.7-8.7.1; 8.8-8.8.5; 8.9-8.9.3; 9.0-9.0.2; 9.1-9.1.4; 9.2-9.2.3; 9.3-9.3.4; 9.4-9.4.3; 9.5-9.5.2; 9.6-9.6.2; 9.7-9.7.1; 9.8-9.8.5; 9.9-9.9.5
Patched versions: 10.0.5, 10.1.3, 10.2.3, 10.3.7, 8.1.3, 8.2.4, 8.3.3, 8.4.2, 8.5.4, 8.6.3, 8.7.2, 8.8.6, 8.9.4, 9.0.3, 9.1.5, 9.2.4, 9.3.5, 9.4.4, 9.5.3, 9.6.3, 9.7.2, 9.8.6, 9.9.6

Original Wordfence record

MediumCVE-2025-49042

WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting

Published: October 29, 2025

Affected versions: *-10.0.2
Patched versions: 10.0.3

Original Wordfence record

MediumCVE-2025-5062

WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting

Published: May 21, 2025

Affected versions: *-9.3.2; 9.4-9.4.2
Patched versions: 9.3.4, 9.4.3

Original Wordfence record

MediumCVE-2025-26762

WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting

Published: March 12, 2025

Affected versions: *-9.7.0
Patched versions: 9.7.1

Original Wordfence record

MediumCVE-2024-9944

WooCommerce <= 9.0.2 - Unauthenticated HTML Injection

Published: October 14, 2024

Affected versions: *-9.0.2
Patched versions: 9.1.0

Original Wordfence record

MediumCVE-2024-39666

WooCommerce <= 9.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: August 16, 2024

Affected versions: *-9.1.2
Patched versions: 9.1.3

Original Wordfence record

LowCVE-2024-35777

WooCommerce <= 8.9.2 - Authenticated (Shop Manager+) Content Injection

Published: June 27, 2024

Affected versions: *-8.9.2
Patched versions: 9.0.0

Original Wordfence record

Highest-Severity Records

High

WooCommerce <= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published: July 2, 2019

Affected versions: [*, 3.6.5)
Patched versions: 3.6.5

Original Wordfence record

HighCVE-2021-32790

WooCommerce < 5.5 - Authenticated Blind SQL Injection

Published: July 13, 2021

Affected versions: [*, 3.3); 3.3-3.3.5; 3.4-3.4.7; 3.5-3.5.8; 3.6-3.6.5; 3.7-3.7.1; 3.8-3.8.1; 3.9-3.9.3; 4.0-4.0.1; 4.1-4.1.1; 4.2-4.2.2; 4.3-4.3.3; 4.4-4.4.1; 4.5-4.5.2; 4.6-4.6.2; 4.7-4.7.1; 4.8; 4.9-4.9.2; 5.0; 5.1; 5.2-5.2.2; 5.3; 5.4-5.4.1; 5.5
Patched versions: 3.3.6, 3.4.8, 3.5.9, 3.6.6, 3.7.2, 3.8.2, 3.9.4, 4.0.2, 4.1.2, 4.2.3, 4.3.4, 4.4.2, 4.5.3, 4.6.3, 4.7.2, 4.8.1, 4.9.3, 5.0.1, 5.1.1, 5.2.3, 5.3.1, 5.4.2, 5.5.1, 5.5.2

Original Wordfence record

HighCVE-2017-18356

WooCommerce <= 3.2.3 - Authenticated PHP Object Injection

Published: November 16, 2017

Affected versions: [*, 3.2.4)
Patched versions: 3.2.4

Original Wordfence record

High

WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification

Published: May 5, 2020

Affected versions: [*, 4.1.0)
Patched versions: 4.1.0

Original Wordfence record

High

WooCommerce <= 2.3.10 - PHP Object Injection

Published: June 10, 2015

Affected versions: *-2.3.10
Patched versions: 2.3.11

Original Wordfence record

HighCVE-2014-6313

WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter

Published: September 15, 2014

Affected versions: [*, 2.2.3)
Patched versions: 2.2.3

Original Wordfence record

High

WooCommerce <= 3.6.4 - Missing File Type Validation

Published: July 2, 2019

Affected versions: *-3.6.4
Patched versions: 3.6.5

Original Wordfence record

HighCVE-2015-2329

WooCommerce <= 2.3.5 - Stored Cross-Site Scripting

Published: March 13, 2015

Affected versions: [*, 2.3.6)
Patched versions: 2.3.6

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory