Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2024-31283HIGHWordPress Advanced Local Pickup for WooCommerce plugin <=1.6.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-31098HIGHWordPress New Order Notification for Woocommerce plugin <= 2.0.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-50421MEDIUMWordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 3.8.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-1044MEDIUMCustomer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_reviewEPSS 0.4%CVE-2024-5769MEDIUMMIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Limited Settings UpdateEPSS 0.4%CVE-2025-60243CRITICALWordPress Selling Commander for WooCommerce plugin <= 1.2.46 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2024-34819MEDIUMWordPress MC Woocommerce Wishlist plugin <= 1.7.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-32593HIGHWordPress Add Product Frontend for WooCommerce plugin <= 1.0.8 - Arbitrary Content Deletion vulnerabilityEPSS 0.4%CVE-2026-1305MEDIUMJapanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order ManipulationEPSS 0.4%CVE-2023-52227MEDIUMWordPress MailerLite – WooCommerce integration plugin <= 2.0.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2022-46843HIGHWordPress Woocommerce Vietnam Checkout Plugin <= 2.0.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-4566HIGHShopLentor <= 2.8.8 - Missing Authorization to WordPress Option ModificationEPSS 0.4%CVE-2022-4227MEDIUMBooster for WooCommerce - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-14460MEDIUMPiraeus Bank WooCommerce Payment Gateway <= 3.1.4 - Missing Authorization to Unauthenticated Arbitrary Order Status ChangeEPSS 0.4%CVE-2024-1686MEDIUMThank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data ExportEPSS 0.4%CVE-2026-3985HIGHCreative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' ParameterEPSS 0.4%CVE-2023-48747MEDIUMWordPress Booster for WooCommerce plugin <= 7.1.2 - Authenticated Production Creation/Modification VulnerabilityEPSS 0.4%CVE-2022-40203MEDIUMWordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.1.5 is vulnerable to Broken Access ControlEPSS 0.4%CVE-2025-14843MEDIUMWizit Gateway for WooCommerce <= 1.3.1 - Missing Authentication to Unauthenticated Arbitrary Order CancellationEPSS 0.4%CVE-2025-15609HIGHFortis For WooCommerce < 1.3.1 - Sensitive API Key DisclosureEPSS 0.4%