Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2024-13922LOWOrder Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page FunctionEPSS 0.4%CVE-2025-49379HIGHWordPress Custom Fields Account Registration For Woocommerce plugin <= 1.2 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2025-32207MEDIUMWordPress Ni WooCommerce Cost Of Goods plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-32181MEDIUMWordPress Search, Filters & Merchandising for WooCommerce plugin <= 3.0.58 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8668MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-8793MEDIUMStore Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More <= 2.7.2.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-47589MEDIUMWordPress CTT Expresso para WooCommerce Plugin <= 3.2.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-47173MEDIUMWordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.62.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-60219CRITICALWordPress WooCommerce Designer Pro Plugin <= 1.9.24 - Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2025-60211HIGHWordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2025-60222HIGHWordPress SUMO Memberships for WooCommerce plugin <= 7.8.0 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2024-4632MEDIUMWooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-12160MEDIUMSeraphinite Bulk Discounts for WooCommerce <= 2.4.6 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-47755MEDIUMWordPress WooCommerce Product Carousel Slider Plugin <= 3.3.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-3547HIGHAll in One B2B for WooCommerce <= 1.0.3 - Multiple CSRFEPSS 0.4%CVE-2025-67909HIGHWordPress Membership For WooCommerce plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2026-11324MEDIUMWooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'EPSS 0.4%CVE-2024-9156MEDIUMTI WooCommerce Wishlist <= 2.8.2 - Unauthenticated SQL Injection via lang parametersEPSS 0.4%CVE-2024-0201MEDIUMProduct Expiry for WooCommerce <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings UpdateEPSS 0.4%CVE-2024-0434MEDIUMWordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_saveEPSS 0.4%