Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2024-32513MEDIUMWordPress Product Feed PRO for WooCommerce plugin <= 13.3.1 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2024-1436MEDIUMWordPress WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit Plugin <= 1.0.9 is vulnerable to Sensitive Data ExposureEPSS 0.4%CVE-2024-31297HIGHWordPress Wholesale For WooCommerce plugin <= 2.3.1 - Unauthenticated Arbitrary Post/Page vulnerabilityEPSS 0.4%CVE-2025-12903HIGHPayment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction FraudEPSS 0.4%CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2026-12936MEDIUMRecurio <= 1.1.3 - Authenticated (Shop Manager+) SQL Injection via 'data' ParameterEPSS 0.4%CVE-2026-14342MEDIUMMail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' ParameterEPSS 0.4%CVE-2025-3876HIGHSMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction FunctionEPSS 0.4%CVE-2024-51626HIGHWordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-43943HIGHWordPress Greenshift Woocommerce Addon plugin < 1.9.8 - Subscriber+ SQL Injection vulnerabilityEPSS 0.4%CVE-2025-68013MEDIUMWordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin <= 2.1.2 - Arbitrary Content Deletion vulnerabilityEPSS 0.4%CVE-2024-3216MEDIUMWooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings ResetEPSS 0.4%CVE-2024-33956MEDIUMWordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-1690MEDIUMTeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.4.10 - Missing Authorization to Authenticated (Subscriber+) User Email ExportEPSS 0.4%CVE-2025-47588CRITICALWordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.9 - Arbitrary Code Execution vulnerabilityEPSS 0.4%CVE-2023-4960MEDIUMWCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-8629MEDIUMWooCommerce Multilingual & Multicurrency with WPML <= 5.3.7 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-31802MEDIUMWordPress Shiptimize for WooCommerce plugin <= 3.1.86 - Settings Change vulnerabilityEPSS 0.4%CVE-2025-31826MEDIUMWordPress Ni WooCommerce Cost Of Goods plugin <= 3.2.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-31757MEDIUMWordPress Free Woocommerce Product Table View plugin <= 1.78 - Broken Access Control vulnerabilityEPSS 0.4%