commerce Vulnerabilities
146 vulnerabilities related to commerce
- PoC2026-08-25CVE-2026-11387: SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation
- PoC2026-08-18CVE-2026-71362: Adobe Commerce/Magento - Customer Session Identity Switch
- PoC2026-08-16CVE-2026-27542: WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation
- PoC2026-07-31CVE-2026-3891: Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
- 2026-06-18WordPress TI WooCommerce Wishlist /wp-json/wc/v3/wishlist/get_products SQL 注入漏洞（CVE-2024-43917）
- PoC2026-06-17CVE-2025-13339: Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
- PoC2026-06-17CVE-2025-13773: WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution
- PoC2026-06-17CVE-2026-10580: Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover
- PoC2026-06-17CVE-2026-49777: WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE
- 2026-05-22WordPress WooCommerce OrderConvo 插件 /wp-json/wooconvo/v1/download-file 文件读取漏洞（CVE-2025-10162）
- PoC2026-05-14CVE-2025-47577: TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload
- PoC2026-05-09CVE-2025-10897: WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read
- 2026-04-30WooCommerce Designer Pro /wp-admin/admin-ajax.php wcdp_convert_resource_cmyk 文件读取漏洞（CVE-2025-10897）
- 2026-04-24WordPress WooCommerce Designer Pro存在任意文件读取(CVE-2025-10897)
- PoC2026-04-16CVE-2026-3396: WCAPF WooCommerce Ajax Product Filter - SQL Injection
- PoC2026-03-25CVE-2026-0926: Prodigy Commerce <= 3.3.0 - Local File Inclusion
- PoC2026-02-24CVE-2024-0705: Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection
- PoC2026-02-24CVE-2025-1303: Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Cross-Site Scripting
- 2026-01-23WordPress Drag and Drop Multiple File Upload for WooCommerce dnd_codedropz_upload_wc 文件上传漏洞（CVE-2025-4403）
- 2026-01-23WordPress Drag and Drop Multiple File Upload for WooCommerce dnd_codedropz_upload_wc 文件上传漏洞（CVE-2025-4403）
- PoC2026-01-16wp-woocommerce-admin-fpd: WordPress Plugin WooCommerce Admin (woocommerce-admin) Full Path Disclosure
- PoC2026-01-08CVE-2024-4455: YITH WooCommerce Ajax Search <= 2.4.0 - Cross-Site Scripting
- PoC2026-01-08wp-yith-woocommerce-wishlist-fpd: WordPress YITH WooCommerce Wishlist - Full Path Disclosure
- PoC2025-12-12wp-woocommerce-admin-fpd: WordPress Plugin WooCommerce Admin (woocommerce-admin) Full Path Disclosure
- PoC2025-12-02CVE-2022-28666: Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update
- 2025-11-14WordPress WooCommerce Designer Pro 插件 /wp-admin/admin-ajax.php wcdp_save_canvas_design_ajax 文件上传漏洞（CVE-2025-6440）
- 2025-11-14WordPress WooCommerce Designer Pro 插件 /wp-admin/admin-ajax.php wcdp_save_canvas_design_ajax 文件上传漏洞（CVE-2025-6440）
- 2025-11-03Adobe Commerce/Magento SessionReaper /customer/address_file/upload 文件上传漏洞（CVE-2025-54236）
- 2025-11-03Adobe Commerce/Magento SessionReaper /customer/address_file/upload 文件上传漏洞（CVE-2025-54236）
- 2025-10-01Code-Projects E-Commerce Website SQL注入漏洞
- 2025-09-19Wordpress WooCommerce Ultimate Gift Card /wp-admin/admin-ajax.php mwb_wgm_preview_mail 文件上传漏洞（CVE-2024-8425）
- 2025-09-19Wordpress WooCommerce Ultimate Gift Card /wp-admin/admin-ajax.php mwb_wgm_preview_mail 文件上传漏洞（CVE-2024-8425）
- 2025-09-11Adobe Commerce 输入验证不当漏洞 可导致远程代码执行
- PoC2025-08-01CVE-2023-2986: Abandoned Cart Lite for WooCommerce - Authentication Bypass
- PoC2025-08-01CVE-2014-4558: WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2018-5316: WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24169: WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting
- PoC2025-08-01CVE-2021-24300: WordPress WooCommerce <1.13.22 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24849: WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection
- PoC2025-08-01CVE-2021-24875: WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24940: WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24991: WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-32789: WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection
- PoC2025-08-01CVE-2022-0149: WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0412: WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection
- PoC2025-08-01CVE-2022-0783: Multiple Shipping Address Woocommerce < 2.0 - SQL Injection
- PoC2025-08-01CVE-2022-0948: WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection
- PoC2025-08-01CVE-2022-1020: WordPress WooCommerce <3.1.2 - Arbitrary Function Call
- PoC2025-08-01CVE-2022-1057: WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection
- PoC2025-08-01CVE-2022-1916: WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-33901: WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Read
- PoC2025-08-01CVE-2022-4140: WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access
- PoC2025-08-01CVE-2022-41840: Welcart eCommerce <=2.7.7 - Local File Inclusion
- PoC2025-08-01CVE-2022-4328: WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload
- PoC2025-08-01CVE-2023-0942: WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-0948: WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-2256: WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-27638: tshirtecommerce PrestaShop Module - SQL Injection
- PoC2025-08-01CVE-2023-27639: PrestaShop TshirteCommerce - Directory Traversal
- PoC2025-08-01CVE-2023-27640: PrestaShop tshirtecommerce - Directory Traversal
- PoC2025-08-01CVE-2023-28121: WooCommerce Payments - Unauthorized Admin Access
- PoC2025-08-01CVE-2023-4547: SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2024-10486: Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File
- PoC2025-08-01CVE-2024-13726: Themes Coder Ecommerce <= 1.3.4 - SQL Injection
- PoC2025-08-01CVE-2024-34102: Adobe Commerce & Magento - CosmicSting
- PoC2025-08-01CVE-2024-4348: osCommerce v4.0 - Cross-site Scripting
- PoC2025-08-01CVE-2024-43917: WordPress TI WooCommerce Wishlist Plugin <= 2.8.2 - SQL Injection
- PoC2025-08-01CVE-2024-8425: WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload
- PoC2025-08-01CVE-2025-1562: Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control
- PoC2025-08-01CVE-2025-1661: HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
- PoC2025-08-01CVE-2025-2907: Order Delivery Date Pro for WooCommerce < 12.3.1 - Arbitrary Option Update
- PoC2025-08-01CVE-2022-1020: WordPress WooCommerce <3.1.2 - Arbitrary Function Call
- PoC2025-08-01CVE-2022-41840: Welcart eCommerce <= 2.7.7 - Unauth Directory Traversal
- PoC2025-08-01coinbase-commerce-csp-bypass: Content-Security-Policy Bypass - Coinbase Commerce
- PoC2025-08-01CVE-2018-25114: osCommerce 2.3.4.1 - Remote Code Execution
- PoC2025-08-01CVE-2019-25152: Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2020-36731: Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update
- PoC2025-08-01nopcommerce-installer: nopCommerce Installer - Detect
- PoC2025-08-01readymade-unilevel-sqli: Readymade Unilevel Ecommerce MLM - SQL Injection
- PoC2025-08-01readymade-unilevel-xss: Readymade Unilevel Ecommerce MLM - Cross-Site Scripting
- PoC2025-08-01checkout-fields-manager-xss: WordPress Checkout Fields Manager for WooCommerce <5.5.7 - Cross-Site Scripting
- PoC2025-08-01elex-woocommerce-xss: WordPress WooCommerce Google Shopping < 1.2.4 - Cross-Site Scripting
- PoC2025-08-01music-store-open-redirect: WordPress eCommerce Music Store <=1.0.14 - Open Redirect
- PoC2025-08-01woocommerce-pdf-invoices-xss: WordPress WooCommerce PDF Invoices & Packing Slips <2.15.0 - Cross-Site Scripting
- PoC2025-08-01wp-smart-manager-sqli: Smart Manager for WooCommerce & WPeC <= 3.9.6 - SQL Injection
- PoC2025-08-01wp-woocommerce-email-verification: Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass
- PoC2025-08-01wp-woocommerce-file-download: Product Input Fields for WooCommerce < 1.2.7 - Unauthenticated File Download
- PoC2025-08-01wp-woocommerce-pdf-invoice-listing: Woocommerce - PDF Invoice Exposure
- PoC2025-08-01CVE-2021-24212: WooCommerce Help Scout - Arbitrary File Upload
- PoC2025-08-01CVE-2022-24086: Adobe Commerce (Magento) - Remote Code Execution
- PoC2025-08-01CVE-2025-54236: Adobe Commerce - Authentication Bypass
- 2025-07-23(CVE-2018-25114) osCommerce Online Merchant 2.3.4.1 远程代码执行漏洞
- 2025-05-24(CVE-2025-5058) eMagicOne Store Manager for WooCommerce插件任意文件上传漏洞
- 2025-05-24（CVE-2025-4602）eMagicOne Store Manager for WooCommerce插件任意文件读取漏洞
- 2025-05-24（CVE-2025-4603）eMagicOne Store Manager for WooCommerce插件任意文件删除漏洞
- 2025-05-24(CVE-2025-4336) eMagicOne Store Manager for WooCommerce插件任意文件上传漏洞
- 2025-05-09(CVE-2025-4403) Drag and Drop Multiple File Upload for WooCommerce插件任意文件上传漏洞
- 2025-04-11Adobe Commerce 跨站请求伪造漏洞
- 2025-04-03HUSKY-WooCommerce /wp-admin/admin-ajax.php 文件包含漏洞 （CVE-2025-1661）
- 2025-04-03HUSKY-WooCommerce /wp-admin/admin-ajax.php 文件包含漏洞 （CVE-2025-1661）
- 2025-03-09Ecommerce-Website 注入漏洞
- 2025-02-14Adobe Commerce 跨站脚本漏洞
- 2025-02-14Adobe Commerce 跨站脚本漏洞
- 2025-02-14Adobe Commerce 跨站脚本漏洞
- 2025-02-14Adobe Commerce 跨站脚本漏洞
- 2025-02-14Adobe Commerce 跨站脚本漏洞
- 2025-02-14Adobe Commerce 跨站脚本漏洞
- 2025-02-14Adobe Commerce 跨站脚本漏洞
- 2025-02-14Adobe Commerce 路径遍历漏洞
- 2025-02-14Adobe Commerce 跨站脚本漏洞
- 2025-02-14Adobe Commerce 跨站脚本漏洞
- 2025-02-06PDF Invoices & Packing Slips for WooCommerce 信息泄露漏洞
- 2025-01-27WordPress plugin PDF Invoices for WooCommerce + Drag and Drop Template Builder 跨站脚本漏洞
- 2025-01-27WordPress plugin WooCommerce Cloak Affiliate Links 跨站请求伪造漏洞
- 2025-01-17WordPress plugin CoDesigner WooCommerce Builder for Elementor 跨站脚本漏洞
- 2024-11-03WordPress plugin SIP Reviews Shortcode for WooCommerce SQL注入漏洞
- 2024-11-03WordPress plugin SIP Reviews Shortcode for WooCommerce SQL注入漏洞
- 2024-08-17Adobe Commerce 跨站请求伪造漏洞
- 2024-08-17Adobe Commerce 跨站请求伪造漏洞
- 2024-08-17Adobe Commerce 跨站脚本漏洞
- 2024-08-17Adobe Commerce 操作系统命令注入漏洞
- 2024-08-17Adobe Commerce 操作系统命令注入漏洞
- 2024-08-17Adobe Commerce 跨站脚本漏洞
- 2024-08-17Adobe Commerce 跨站请求伪造漏洞
- 2024-08-17Adobe Commerce 路径遍历漏洞
- 2024-08-17Adobe Commerce 路径遍历漏洞
- 2024-08-14Adobe Commerce CVE-2024-34102 XML外部实体注入漏洞
- 2024-06-18Adobe Commerce 未授权 外部实体注入漏洞
- 2024-06-14WordPress plugin USPS Shipping for WooCommerce – Live Rates 日志信息泄露漏洞
- 2024-05-23T-Soft E-Commerce CVE-2022-28132SQL注入漏洞
- 2024-05-08osCommerce install.php存在远程代码执行漏洞
- 2024-02-22Adobe Commerce CVE-2022-24086 远程代码执行漏洞
- 2024-02-22nopCommerce CVE-2022-28451目录遍历漏洞
- 2024-02-07WordPress 插件 Membership For WooCommerce CVE-2022-4395 任意文件上传漏洞
- 2024-02-07Adobe Commerce and Magento Open Source Group.php XSS漏洞
- 2023-08-06wordpress插件Welcart e-Commerce < 2.8.5文件读取(CVE-2022-4140)
- 2023-06-08WordPress Plugin Abandoned Cart Lite for WooCommerce 安全漏洞
- 2023-06-07WordPress Plugin WooCommerce Multi Currency 安全漏洞
- 2023-05-11WordPress Welcart e-Commerce 插件 content-log.php 文件 logfile 参数文件读取漏洞
- 2023-05-11WordPress Welcart e-Commerce 插件 content-log.php 文件 logfile 参数文件读取漏洞
- 2022-11-03Welcart eCommerce <= 2.7.7文件包含(CVE-2022-41840)
- 2022-10-07WordPress TI WooCommerce Wishlist plugin SQL注入漏洞(CVE-2022-0412)
- 2022-02-15Magento 输入验证错误漏洞
- 2022-01-18WordPress 跨站请求伪造漏洞
- 2019-08-14SAP Commerce Cloud virtualjdbc 远程代码执行漏洞
- 2009-05-18Instinct WP e-Commerce 'image_processing.php'任意文件上传漏洞