Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2021-38349MEDIUMIntegration of Moneybird for WooCommerce <= 2.1.1 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-24928—Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL InjectionEPSS 0.9%CVE-2022-2429MEDIUMUltimate SMS Notifications for WooCommerce <= 1.4.1 - CSV InjectionEPSS 0.9%CVE-2021-25062—Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-4331HIGHThe Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Privilege EscalationEPSS 0.9%CVE-2024-3957MEDIUMBooster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.9%CVE-2025-32568CRITICALWordPress EmpikPlace for Woocommerce Plugin <= 1.4.3 - PHP Object Injection vulnerabilityEPSS 0.9%CVE-2023-5601CRITICALWooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2025-1913HIGHProduct Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data ParameterEPSS 0.9%CVE-2023-5957HIGHNi Purchase Order(PO) For WooCommerce <= 1.2.1 - Admin+ File Upload to Remote Code ExecutionEPSS 0.9%CVE-2021-25077—Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-25043—WOOCS < 1.3.7.3 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2022-0399—Advanced Product Labels for WooCommerce < 1.2.3.7 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2023-2843HIGHMultiParcels Shipping For WooCommerce < 1.14.15 - Subscribers+ SQLiEPSS 0.9%CVE-2022-0818—Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSSEPSS 0.9%CVE-2024-9756MEDIUMOrder Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File UploadEPSS 0.9%CVE-2022-4106HIGHWholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File DownloadEPSS 0.9%CVE-2025-5391HIGHWooCommerce Purchase Orders <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 0.9%CVE-2024-10627CRITICALWooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2025-12975HIGHCTX Feed – WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin InstallationEPSS 0.9%