Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2026-66466HIGHWordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-66461HIGHWordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerabilityEPSS 0.3%CVE-2026-66431HIGHWordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-59547HIGHWordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-59530HIGHWordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-56061HIGHWordPress Subscriptions for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-56025HIGHWordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-48883HIGHWordPress WPC Product Bundles for WooCommerce plugin <= 8.5.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-81790HIGHWordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-40741HIGHWordPress Redsys for WooCommerce Light plugin <= 7.0.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-27345HIGHWordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-39448HIGHWordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-81794HIGHWordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-81799HIGHWordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-34898HIGHWordPress Event Tickets Manager for WooCommerce plugin <= 1.5.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-12468MEDIUMFunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information ExposureEPSS 0.3%CVE-2024-4233MEDIUMBroken Access Control vulnerability in multiple WordPress plugins by Tyche SoftwaresEPSS 0.3%CVE-2025-32687HIGHWordPress Review Stars Count For WooCommerce plugin <= 2.0 - SQL Injection VulnerabilityEPSS 0.3%CVE-2024-11938MEDIUMOne Click Upsell Funnel for WooCommerce <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes ShortcodeEPSS 0.3%CVE-2026-87854MEDIUMSubscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key BypassEPSS 0.3%