Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2026-49072MEDIUMWordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57340MEDIUMWordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-56050MEDIUMWordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-56048MEDIUMWordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-78536MEDIUMWordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-81792MEDIUMWordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.4 - Privilege Escalation vulnerabilityEPSS 0.3%CVE-2026-57425MEDIUMWordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57424MEDIUMWordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57400MEDIUMWordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57390MEDIUMWordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-56013MEDIUMWordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-25469MEDIUMWordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerabilityEPSS 0.3%CVE-2023-45101MEDIUMWordPress Customer Reviews for WooCommerce plugin <= 5.36.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-13088HIGHCategory and Product Woocommerce Tabs <= 1.0 - Authenticated (Contributor+) Local File InclusionEPSS 0.3%CVE-2023-45006HIGHWordPress WooODT Lite Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-46094HIGHWordPress Conversios.io Plugin <= 6.5.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-46076HIGHWordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.102 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-15033MEDIUMWooCommerce - Subscriber/Customer+ Order Data DisclosureEPSS 0.3%CVE-2026-6725MEDIUMWPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributeEPSS 0.3%CVE-2026-15646MEDIUMBrands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode AttributeEPSS 0.3%