Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2023-50369MEDIUMWordPress Alma – Pay in installments or later for WooCommerce Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-31795MEDIUMWordPress Shopify to WooCommerce Migration plugin <= 1.3.0 - Settings Change vulnerabilityEPSS 0.4%CVE-2023-32793MEDIUMWordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32746MEDIUMWordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-2568MEDIUMVayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options UpdateEPSS 0.4%CVE-2026-78474MEDIUMNi WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' ParameterEPSS 0.4%CVE-2024-10854MEDIUMBuy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings ImportEPSS 0.4%CVE-2024-29121HIGHWordPress WooCommerce License Manager plugin <= 5.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-29116HIGHWordPress WooThumbs for WooCommerce by Iconic plugin <= 5.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-5530MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter WidgetEPSS 0.4%CVE-2026-40725CRITICALWordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-14169HIGHFunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL InjectionEPSS 0.4%CVE-2024-27999HIGHWordPress Preview E-mails for WooCommerce plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-24881HIGHWordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-8724MEDIUMWaitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-6897MEDIUMEAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via ShortcodeEPSS 0.4%CVE-2025-49417CRITICALWordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data VulnerabilityEPSS 0.4%CVE-2025-9054CRITICALMultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'EPSS 0.4%CVE-2023-41691HIGHWordPress WooCommerce PensoPay Plugin <= 6.3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-39162HIGHWordPress User Email Verification for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%