Woodmart

Woodmart has 19 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 19 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 5 high. 2025 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (32%). Other recurring categories include Code Injection, Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 19 issues recorded for Woodmart has a vendor fix available, so running the current release closes all known holes.

10 independent researchers contributed these findings, most of them (4) reported by stealthcopter.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Woodmart vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-6746

WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion

Read the full analysis

Vulnerability Records

19 records


2026-09-04 00:00	Woodmart < 8.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Woodmart < 8.3.8	`CVE-2026-27086`	6.4 Medium	João Pedro S Alcântara	Yes
2026-06-25 00:00	Woodmart <= 8.5.3 - Unauthenticated Stored Cross-Site Scripting Woodmart <= 8.5.3	`CVE-2026-56072`	7.2 High	daroo	Yes
2026-03-23 00:00	Woodmart <= 8.3.8 - Unauthenticated PHP Object Injection Woodmart <= 8.3.8	`CVE-2026-23971`	8.1 High	Phat RiO	Yes
2026-02-22 00:00	WoodMart <= 8.3.9 - Unauthenticated Sensitive Information Exposure Woodmart <= 8.3.9	`CVE-2026-32405`	5.3 Medium	Phat RiO	Yes
2026-01-09 00:00	WoodMart <= 8.3.7 - Unauthenticated Arbitrary Shortcode Execution Woodmart <= 8.3.7	`CVE-2025-47600`	6.5 Medium	João Pedro Soares de Alcântara	Yes
2025-10-14 00:00	WoodMart < 8.3.2 - Authenticated (Contributor+) Local File Inclusion Woodmart < 8.3.2	`CVE-2025-49935`	7.5 High	João Pedro Soares de Alcântara	Yes
2025-10-10 00:00	WoodMart < 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Woodmart < 8.3.2	`CVE-2025-49936`	6.4 Medium	João Pedro Soares de Alcântara	Yes
2025-07-25 00:00	WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation Woodmart <= 8.2.6	`CVE-2025-8097`	5.3 Medium	Samir El Khaouti	Yes
2025-07-10 00:00	WoodMart <= 8.2.5 - Unauthenticated Post Disclosure Woodmart <= 8.2.5	`CVE-2025-6745`	5.3 Medium	stealthcopter	Yes
2025-07-07 17:26	WoodMart <= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Woodmart <= 8.2.3	`CVE-2025-6743`	6.4 Medium	stealthcopter	Yes

Showing 1–10 of 19 reports