Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2024-13925HIGHKlarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive LoggingEPSS 0.5%CVE-2026-22480HIGHWordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2023-0537MEDIUMProduct Slider For WooCommerce Lite <= 1.1.7 - Contributor+ Stored XSSEPSS 0.5%CVE-2025-30807CRITICALWordPress Next-Cart Store to WooCommerce Migration plugin <= 3.9.4 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-76801HIGHFireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege EscalationEPSS 0.5%CVE-2024-32511CRITICALWordPress Simple Registration for WooCommerce plugin <= 1.5.6 - Unauthenticated Privilege Escalation vulnerabilityEPSS 0.5%CVE-2026-2019HIGHCart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' SettingEPSS 0.5%CVE-2024-24796HIGHWordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object InjectionEPSS 0.5%CVE-2026-3208MEDIUMMercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image DisclosureEPSS 0.5%CVE-2023-30479MEDIUMWordPress Stamped.io Product Reviews & UGC for WooCommerce plugin <= 2.3.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-12492CRITICALHappy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_userEPSS 0.5%CVE-2024-38772MEDIUMWordPress JetWidgets for Elementor and WooCommerce plugin <= 1.1.7 - Contributor+ Limited Local File Inclusion vulnerabilityEPSS 0.5%CVE-2023-44149MEDIUMWordPress Brands for WooCommerce plugin <= 3.8.2.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-18442HIGHWCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' ParameterEPSS 0.5%CVE-2026-2421MEDIUMilGhera Carta Docente for WooCommerce <= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' ParameterEPSS 0.5%CVE-2024-39651HIGHWordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerabilityEPSS 0.5%CVE-2024-7747MEDIUMWallet for WooCommerce <= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric TypesEPSS 0.5%CVE-2024-44048MEDIUMWordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerabilityEPSS 0.5%CVE-2022-36379HIGHWordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Cross-Site Request Forgery (CSRF) leading to plugin settings updateEPSS 0.5%CVE-2024-12421MEDIUMCoupon Affiliates – Affiliate Plugin for WooCommerce <= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site ScriptingEPSS 0.5%