Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2025-48331HIGHWordPress WooCommerce Orders & Customers Exporter <= 5.0 - Sensitive Data Exposure VulnerabilityEPSS 0.4%CVE-2026-81280MEDIUMWordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2023-51495MEDIUMWordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-65434MEDIUMWordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2024-4564MEDIUMCoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%CVE-2024-38680HIGHWordPress Appmaker plugin <= 1.36.12 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-46822HIGHWordPress WooCommerce – Store Exporter Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-54333HIGHWordPress Check Pincode For Woocommerce plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-54328HIGHWordPress Invoice Payment for WooCommerce plugin <= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-52460HIGHWordPress AtaraPay WooCommerce Payment Gateway plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-25328MEDIUMWordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerabilityEPSS 0.4%CVE-2025-39520MEDIUMWordPress Checkout Files Upload for WooCommerce plugin <= 2.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2020-36834MEDIUMDiscount Rules for WooCommerce <= 2.0.2 - Missing AuthorizationEPSS 0.4%CVE-2024-11324MEDIUMAccounting for WooCommerce <= 1.6.6 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-24668MEDIUMWordPress PPOM for WooCommerce plugin <= 33.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-24681MEDIUMWordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin <= 1.10.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-24657MEDIUMWordPress Wishlist for WooCommerce plugin <=2.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-1370MEDIUMSIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' ParameterEPSS 0.4%CVE-2024-10853MEDIUMBuy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order DeletionEPSS 0.4%CVE-2025-48122CRITICALWordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - SQL Injection VulnerabilityEPSS 0.4%