Exposure of WooCommerce

Ecommerce, WordPress plugins
2,628
exposure score
568,489
sites use
0
exploited
186
critical
Vexday analysis

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2,368 results
CVE-2024-51693HIGHWordPress Search order by product SKU for WooCommerce plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51784HIGHWordPress FriendStore for WooCommerce plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-52757MEDIUMWordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Arbitrary Content Deletion vulnerabilityEPSS 0.3%CVE-2025-39362MEDIUMWordPress Mollie Payments for WooCommerce plugin <= 8.0.2 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2025-3878MEDIUMSMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify ShortcodeEPSS 0.3%CVE-2023-32500MEDIUMWordPress WoodMart Theme <= 7.1.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-49759MEDIUMWordPress WooDiscuz – WooCommerce Comments Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-49761MEDIUMWordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-48778MEDIUMWordPress Product Size Chart For WooCommerce Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-12392MEDIUMCryptocurrency Payment Gateway for WooCommerce <= 2.0.25 - Missing Authorization to Unauthenticated Tracking Status UpdateEPSS 0.3%CVE-2025-67929MEDIUMWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-13666MEDIUMHelloprint <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status ModificationEPSS 0.3%CVE-2025-68994MEDIUMWordPress Product Loops for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-68993MEDIUMWordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-31919MEDIUMWordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-66692MEDIUMWordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-65456MEDIUMWordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-32406MEDIUMWordPress WPC Product Bundles for WooCommerce plugin <= 8.4.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-15214MEDIUMSubscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOREPSS 0.3%CVE-2024-2384MEDIUMWooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information DisclosureEPSS 0.3%