Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2025-28947HIGHWordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2023-25998HIGHWordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2023-37972MEDIUMWordPress WooCommerce Product Stock Alert Plugin <= 2.0.1 is vulnerable to Sensitive Data ExposureEPSS 0.7%CVE-2022-2537—WooCommerce PDF Invoices & Packing Slips < 3.0.1 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2024-3934MEDIUMMercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File DownloadEPSS 0.7%CVE-2023-4216LOWOrders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/ReadEPSS 0.7%CVE-2023-4603MEDIUMStar CloudPRNT for WooCommerce <= 2.0.3 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2026-15291HIGHChat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information ExposureEPSS 0.7%CVE-2023-35881HIGHWordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2024-1668MEDIUMAvada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form EntriesEPSS 0.7%CVE-2026-16777MEDIUMStore Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' ParameterEPSS 0.7%CVE-2022-41655MEDIUMWordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerabilityEPSS 0.7%CVE-2021-4347CRITICALAdvanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options ChangeEPSS 0.7%CVE-2022-2099—WooCommerce < 6.6.0 - Admin+ Stored HTML InjectionEPSS 0.7%CVE-2024-0610CRITICALPiraeus Bank WooCommerce Payment Gateway <= 1.6.5.1 - Unauthenticated SQL InjectionEPSS 0.7%CVE-2023-51505CRITICALWordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to PHP Object InjectionEPSS 0.7%CVE-2022-0426—Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2020-36711MEDIUMAvada <= 6.2.2 - Authenticated (Contributor+) Cross-Site ScriptingEPSS 0.6%CVE-2024-32807HIGHWordPress Brevo for WooCommerce plugin <= 4.0.17 - Arbitrary File Download and Deletion vulnerabilityEPSS 0.6%CVE-2023-52218CRITICALWordPress WooCommerce Tranzila Gateway Plugin <= 1.0.8 is vulnerable to PHP Object InjectionEPSS 0.6%