Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2024-5335CRITICALUltimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object InjectionEPSS 0.9%CVE-2024-4185HIGHCustomer Email Verification for WooCommerce <= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient RandomnessEPSS 0.9%CVE-2023-0948MEDIUMJapanized For WooCommerce < 2.5.8 - Reflected XSSEPSS 0.9%CVE-2022-1532—Themify - WooCommerce Product Filter < 1.3.8 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-1465—WPC Smart Wishlist for WooCommerce < 2.9.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2025-4200HIGHZagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File InclusionEPSS 0.8%CVE-2023-35876HIGHWordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)EPSS 0.8%CVE-2024-2344HIGHAvada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entryEPSS 0.8%CVE-2021-24679—Bitcoin / AltCoin Payment Gateway for WooCommerce < 1.6.1 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2021-24588—SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site ScriptingEPSS 0.8%CVE-2022-0215HIGHXootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options UpdateEPSS 0.8%CVE-2024-12040HIGHProduct Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'EPSS 0.8%CVE-2024-2025HIGHBuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_requestEPSS 0.8%CVE-2025-6439CRITICALWooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File DeletionEPSS 0.8%CVE-2024-8922HIGHProduct Enquiry for WooCommerce <= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry_detail.phpEPSS 0.8%CVE-2023-32242CRITICALWordPress Woodmart Core Plugin <= 1.0.36 is vulnerable to PHP Object InjectionEPSS 0.8%CVE-2022-4108MEDIUMWholesale Market for WooCommerce < 1.0.8 - Admin+ Arbitrary File DownloadEPSS 0.8%CVE-2023-3677HIGHWooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via ExportEPSS 0.8%CVE-2021-4332MEDIUMThe Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File ReadEPSS 0.8%CVE-2022-2092—WooCommerce PDF Invoices & Packing Slips < 2.16.0 - Reflected Cross-Site ScriptingEPSS 0.8%