WooCommerce vulnerabilities

WooCommerce version 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter.

There is an unauthenticated privilege escalation vulnerability in the registration form for WooCommerce versions <= 1.0.9.

WooCommerce versions up to 4.5.1 contain a vulnerability for unauthenticated SQL injection in the order delivery date field.

Incorrect privilege assignment vulnerability in WooCommerce. Allows privilege escalation. Affects versions from 9.8.0 through 11.1.2.

Resource exhaustion vulnerability without limits or throttling in Automattic WooCommerce allows HTTP DoS. This affects WooCommerce versions before 11.1.0.

WooCommerce plugin by Automattic contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. Affects versions before 11.0.

In WooCommerce versions up to 3.1.4, there is a vulnerability of unauthenticated broken authentication in the Upsell Order Bump Offer feature.

The WooCommerce plugin by Automattic up to version 10.0.2 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Attackers can inject malicious scripts that execute in the victim's browser.

The WooCommerce WordPress plugin before version 8.6 fails to prevent users with at least the contributor role from leaking products they should not have access to, such as private, draft, and trashed products.