Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2023-0068—Product GTIN (EAN, UPC, ISBN) for WooCommerce <= 1.1.1 - Contributor+ Stored XSSEPSS 0.5%CVE-2022-4661—Woo Products Widgets For Elementor < 1.0.8 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2023-5325—Woocommerce Vietnam Checkout < 2.0.6 - Unauthenticated Stored XSS EPSS 0.5%CVE-2025-31089HIGHWordPress Order Splitter for WooCommerce plugin <= 5.3.0 - SQL Injection VulnerabilityEPSS 0.5%CVE-2024-30511MEDIUMWordPress FG PrestaShop to WooCommerce plugin <= 4.45.1 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.5%CVE-2025-48123CRITICALWordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Remote Code Execution (RCE) VulnerabilityEPSS 0.5%CVE-2025-8898CRITICALTaxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account TakeoverEPSS 0.5%CVE-2025-24639MEDIUMWordPress Korea for WooCommerce plugin <= 1.1.11 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2023-40602MEDIUMWordPress Doofinder for WooCommerce Plugin <= 1.5.49 is vulnerable to Open RedirectionEPSS 0.5%CVE-2023-38481MEDIUMWordPress Integration for WooCommerce and Zoho CRM Plugin < 1.3.7 is vulnerable to Open RedirectionEPSS 0.5%CVE-2023-38478MEDIUMWordPress Integration for WooCommerce and QuickBooks Plugin <= 1.2.3 is vulnerable to Open RedirectionEPSS 0.5%CVE-2024-13623MEDIUMOrder Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected DirectoryEPSS 0.5%CVE-2025-9286CRITICALAppy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_passwordEPSS 0.5%CVE-2025-69131HIGHWordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Download vulnerabilityEPSS 0.5%CVE-2026-22334HIGHWordPress Woocommerce Book Price plugin <= 1.3 - Arbitrary File Download vulnerabilityEPSS 0.5%CVE-2026-73181HIGHWordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerabilityEPSS 0.5%CVE-2024-9927HIGHWooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order ProposalEPSS 0.5%CVE-2024-8716MEDIUMXT Ajax Add To Cart for WooCommerce <= 1.1.2 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-2275MEDIUMWooCommerce Multivendor Marketplace – REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST APIEPSS 0.5%CVE-2025-47532CRITICALWordPress CoinPayments.net Payment Gateway for WooCommerce plugin <= 1.0.17 - PHP Object Injection VulnerabilityEPSS 0.5%