Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2025-62750MEDIUMWordPress WooCommerce Parcelas plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-14767MEDIUMWPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' AttributeEPSS 0.2%CVE-2025-31032HIGHWordPress Pagopar – WooCommerce Gateway plugin <= 2.7.1 - CSRF to Stored XSS vulnerabilityEPSS 0.2%CVE-2024-12004MEDIUMWPC Order Notes for WooCommerce <= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site ScriptingEPSS 0.2%CVE-2024-2382MEDIUMAuthorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment BypassEPSS 0.2%CVE-2025-7827MEDIUMNi WooCommerce Customer Product Report <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Settings UpdateEPSS 0.2%CVE-2025-12123MEDIUMCustomer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2025-12398MEDIUMProduct Table for WooCommerce <= 5.0.8 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2025-13137MEDIUMLive Sales Notification for Woocommerce – Woomotiv <= 3.6.3 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2025-2799MEDIUMWP Event Manager <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-31807MEDIUMWordPress Product Notices for WooCommerce plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2024-32105MEDIUMWordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-12095HIGHSimple Registration for WooCommerce <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request ApprovalEPSS 0.2%CVE-2025-58917MEDIUMWordPress Quantities and Units for WooCommerce plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-49908MEDIUMWordPress WPC Countdown Timer for WooCommerce plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-29001MEDIUMWordPress WooCommerce Shop Page Builder plugin <= 2.27.7 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-22638MEDIUMWordPress Product Table For WooCommerce Plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-66109MEDIUMWordPress Cart Weight for WooCommerce plugin <= 1.9.11 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-64296MEDIUMWordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerabilityEPSS 0.2%CVE-2025-66114MEDIUMWordPress Show Variations as Single Products Woocommerce plugin <= 2.0 - Broken Access Control vulnerabilityEPSS 0.2%