Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2024-13792HIGHWooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via idsEPSS 0.5%CVE-2022-2518HIGHStockists Manager for Woocommerce <= 1.0.2.1 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-12432HIGHWPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique KeyEPSS 0.5%CVE-2023-50853HIGHWordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.75.0 is vulnerable to SQL InjectionEPSS 0.5%CVE-2023-49194MEDIUMWordPress Importify (Dropshipping WooCommerce) plugin <= 1.0.4 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2025-4387HIGHAbandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.5%CVE-2024-56230HIGHWordPress Dynamic Product Category Grid, Slider for WooCommerce plugin <= 1.1.3 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2025-29009CRITICALWordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload VulnerabilityEPSS 0.5%CVE-2024-0608MEDIUMWP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL InjectionEPSS 0.5%CVE-2023-37989MEDIUMWordPress Easyship WooCommerce Shipping Rates plugin <= 0.9.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-34376MEDIUMWordPress Change WooCommerce Add To Cart Button Text plugin <= 1.3 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-30618CRITICALWordPress Rapyd Payment Extension for WooCommerce plugin <= 1.2.0 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2026-9612MEDIUMWhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLsEPSS 0.5%CVE-2022-45070MEDIUMWordPress Conditional Checkout Fields for WooCommerce plugin <= 1.2.3 - Broken Authentication vulnerabilityEPSS 0.5%CVE-2024-0956MEDIUMWP ERP <= 1.13.0 - Authenticated (AccountingManager+) SQL InjectionEPSS 0.5%CVE-2023-50856HIGHWordPress Funnel Builder for WordPress by FunnelKit Plugin <= 2.14.3 is vulnerable to SQL InjectionEPSS 0.5%CVE-2024-32602HIGHWordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.3.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-48124HIGHWordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Arbitrary File Download VulnerabilityEPSS 0.5%CVE-2023-6638MEDIUMGTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings UpdateEPSS 0.5%CVE-2023-5234MEDIUMRelated Products for WooCommerce <= 3.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%