Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2025-14294MEDIUMRazorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order ModificationEPSS 0.4%CVE-2026-5651MEDIUMAskeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' ParameterEPSS 0.4%CVE-2023-50850MEDIUMWordPress Woo Subscriptions plugin < 5.8.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-22639HIGHWordPress Distance Rate Shipping for WooCommerce plugin <= 1.3.4 - SQL Injection vulnerabilityEPSS 0.4%CVE-2025-22505HIGHWordPress NC Wishlist for Woocommerce Plugin <= 1.0.1 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-23977HIGHWordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-55996MEDIUMWordPress Payment gateway per Product for WooCommerce plugin <= 3.5.6 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-0679MEDIUMFortis for WooCommerce <= 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' EndpointEPSS 0.4%CVE-2026-9027MEDIUMCorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST EndpointEPSS 0.4%CVE-2025-54692HIGHWordPress Membership For WooCommerce Plugin <= 2.9.0 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2026-49056HIGHWordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2024-54241MEDIUMWordPress Elite Notification plugin 1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-4983MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-51494MEDIUMWordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-32811MEDIUMWordPress USPS Shipping for WooCommerce – Live Rates plugin <= 1.9.4 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.4%CVE-2025-49887CRITICALWordPress Product XML Feed Manager for WooCommerce Plugin <= 2.9.3 - Remote Code Execution (RCE) VulnerabilityEPSS 0.4%CVE-2025-1514HIGHActive Products Tables for WooCommerce <= 1.0.6.7 - Unauthenticated Arbitrary Filter CallEPSS 0.4%CVE-2024-10046MEDIUMافزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.0.5 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-1258MEDIUMMail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API EndpointsEPSS 0.4%CVE-2024-12517MEDIUMWooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%