Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2026-15215HIGHSubscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin InstallationEPSS 0.4%CVE-2024-2322MEDIUMWooCommerce Cart Abandonment Recovery < 1.2.27 - Templates/Abandoned Orders Deletion via CSRFEPSS 0.4%CVE-2023-52230MEDIUMWordPress Booster Plus for WooCommerce plugin < 7.1.3 - Authenticated Arbitrary WordPress Option Disclosure VulnerabilityEPSS 0.4%CVE-2024-12861MEDIUMW2S – Migrate WooCommerce to Shopify <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File ReadEPSS 0.4%CVE-2024-11418MEDIUMAdditional Order Filters for WooCommerce <= 1.21 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-29929MEDIUMWordPress WCFM plugin <= 6.7.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-45217MEDIUMWordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerabilityEPSS 0.4%CVE-2026-12654MEDIUMPayment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook SecretEPSS 0.4%CVE-2026-4896HIGHWCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product ManipulationEPSS 0.4%CVE-2026-7529HIGHwiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST APIEPSS 0.4%CVE-2023-51501HIGHWordPress Uncode Core Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-50893HIGHWordPress UpSolution Core Plugin <= 8.17.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-44144HIGHWordPress Dreamfox Media Payment gateway per Product for Woocommerce Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41874HIGHWordPress Order Delivery Date for WooCommerce Plugin <= 3.20.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-35662MEDIUMWordPress Simple COD Fees for WooCommerce plugin <= 2.0.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-30466MEDIUMWordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-41240MEDIUMWordPress Pricing Deals for WooCommercePricing Deals for WooCommerce plugin <= 2.0.3.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-35777LOWWordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerabilityEPSS 0.4%CVE-2026-2232HIGHProduct Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' ParameterEPSS 0.4%CVE-2025-24597MEDIUMWordPress Barcode Generator for WooCommerce plugin <= 2.0.2 - Sensitive Data Exposure vulnerabilityEPSS 0.4%