Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2025-2719MEDIUMSwatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options UpdateEPSS 0.3%CVE-2026-49059MEDIUMWordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerabilityEPSS 0.3%CVE-2025-11742MEDIUMWPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information ExposureEPSS 0.3%CVE-2026-16577LOWDokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied AmountEPSS 0.3%CVE-2025-26878MEDIUMWordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.8.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14298MEDIUMFiboSearch – Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search ShortcodeEPSS 0.3%CVE-2023-48773MEDIUMWordPress WooCommerce Login Redirect Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2024-37544MEDIUMWordPress Get Better Reviews for WooCommerce plugin <= 4.0.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-10614MEDIUMCustomer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import CancellationEPSS 0.3%CVE-2025-11890HIGHCrypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment BypassEPSS 0.3%CVE-2025-49947HIGHWordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1064MEDIUMLogin/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action ShortcodeEPSS 0.3%CVE-2024-35698MEDIUMWordPress YITH WooCommerce Tab Manager plugin <= 1.35.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-3815MEDIUMNewspaper <= 12.6.5 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment MetaEPSS 0.3%CVE-2025-13441MEDIUMHide Category by User Role for WooCommerce <= 2.3.1 - Missing Authorization to Unauthenticated Cache FlushingEPSS 0.3%CVE-2025-12655MEDIUMHippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File WriteEPSS 0.3%CVE-2025-48117MEDIUMWordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-32398MEDIUMWordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerabilityEPSS 0.3%CVE-2025-22667MEDIUMWordPress Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets plugin <= 1.8.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-1381MEDIUMOrder Minimum/Maximum Amount Limits for WooCommerce <= 4.6.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Hide Add to Cart Content FieldsEPSS 0.3%