Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2023-32296HIGHWordPress Kangu para WooCommerce Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-3731MEDIUMCustomer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's'EPSS 0.4%CVE-2024-0957MEDIUMWooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-34379MEDIUMWordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access ControlEPSS 0.4%CVE-2023-51511MEDIUMWordPress Booster Elite for WooCommerce plugin < 7.1.3 - Authenticated Production Creation/Modification VulnerabilityEPSS 0.4%CVE-2024-9213MEDIUMPersian WooCommerce SMS <= 7.0.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-6566MEDIUMAramex Shipping WooCommerce <= 1.1.21 - Unauthenticated Full Path DisclosureEPSS 0.4%CVE-2025-12883MEDIUMCampay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment BypassEPSS 0.4%CVE-2025-69045HIGHWordPress FooEvents for WooCommerce plugin <= 1.20.4 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-29805HIGHWordPress Shipping with Venipak for WooCommerce plugin <= 1.19.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-32687MEDIUMWordPress WPC Frequently Bought Together for WooCommerce plugin <= 7.0.3 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-23967CRITICALWordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection VulnerabilityEPSS 0.4%CVE-2026-32522HIGHWordPress WooCommerce Support Ticket System plugin < 18.5 - Arbitrary File Deletion vulnerabilityEPSS 0.4%CVE-2025-58788HIGHWordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection VulnerabilityEPSS 0.4%CVE-2026-57393MEDIUMWordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2026-61945MEDIUMWordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2026-11364MEDIUMProduct Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX ActionsEPSS 0.4%CVE-2024-27959HIGHWordPress APIExperts Square for WooCommerce plugin <= 4.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-3609MEDIUMReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.27 - Missing AuthorizationEPSS 0.4%CVE-2024-5669MEDIUMXPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%