Exposure of WooCommerce

Ecommerce, WordPress plugins
1,859
exposure score
591,334
sites use
0
exploited
159
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,053 results
CVE-2023-41132MEDIUMWordPress Category Slider for WooCommerce plugin <= 1.4.15 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-32234MEDIUMWordPress AdMail plugin <= 1.7.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-13077HIGHافزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL InjectionEPSS 0.4%CVE-2025-54697HIGHWordPress Kadence WooCommerce Email Designer Plugin <= 1.5.16 - Privilege Escalation VulnerabilityEPSS 0.4%CVE-2024-29121HIGHWordPress WooCommerce License Manager plugin <= 5.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-29116HIGHWordPress WooThumbs for WooCommerce by Iconic plugin <= 5.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-5530MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter WidgetEPSS 0.4%CVE-2024-54227MEDIUMWordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-40725CRITICALWordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2024-27999HIGHWordPress Preview E-mails for WooCommerce plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-24881HIGHWordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-6897MEDIUMEAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via ShortcodeEPSS 0.4%CVE-2025-49417CRITICALWordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data VulnerabilityEPSS 0.4%CVE-2023-32793MEDIUMWordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32746MEDIUMWordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-3731MEDIUMCustomer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's'EPSS 0.4%CVE-2024-0957MEDIUMWooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-34379MEDIUMWordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access ControlEPSS 0.4%CVE-2024-13320HIGHCURCY - WooCommerce Multi Currency - Currency Switcher <= 2.3.6 - Unauthenticated SQL InjectionEPSS 0.4%CVE-2023-51511MEDIUMWordPress Booster Elite for WooCommerce plugin < 7.1.3 - Authenticated Production Creation/Modification VulnerabilityEPSS 0.4%

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →