Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2024-12265MEDIUMWeb3 Cryptocurrency Payments by DePay for WooCommerce <= 2.12.17 - Missing Authorization to Information ExposureEPSS 0.4%CVE-2026-8457CRITICALWooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWTEPSS 0.4%CVE-2024-32675MEDIUMWordPress Order Limit for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-5062MEDIUMWooCommerce <= 9.4.2 - PostMessage-Based Cross-Site ScriptingEPSS 0.4%CVE-2025-47687CRITICALWordPress StoreKeeper for WooCommerce plugin <= 14.4.4 - Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2026-54807CRITICALWordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2023-47697HIGHWordPress WP Event Manager Plugin <= 3.1.39 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-54240HIGHWordPress Blaze Online eParcel for WooCommerce plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54312HIGHWordPress افزونه پیامک ووکامرس Persian WooCommerce SMS plugin <= 7.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54236HIGHWordPress Ni WooCommerce Bulk Product Editor plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54231HIGHWordPress Ni WooCommerce Order Export plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54235HIGHWordPress Shiptimize for WooCommerce plugin <= 3.1.86 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9377MEDIUMProducts, Order & Customers Export for WooCommerce <= 2.0.15 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-9170MEDIUMBooster for WooCommerce <= 7.2.3 - Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta ShortcodeEPSS 0.4%CVE-2025-31056CRITICALWordPress WhatsCart plugin <= 1.1.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2023-37870HIGHWordPress WooCommerce Warranty Requests plugin <= 2.1.9 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-69378HIGHWordPress Product Filter for WooCommerce plugin <= 9.1.2 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2023-32299MEDIUMWordPress Ni WooCommerce Sales Report plugin <= 3.7.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-10735HIGHShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update ServerEPSS 0.4%CVE-2026-10041MEDIUMWCFM – Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX HandlersEPSS 0.4%