Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2026-65501MEDIUMWordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-28180MEDIUMWordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2023-52186MEDIUMWordPress WooCommerce Product Vendors plugin <= 2.2.2 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-51496MEDIUMWordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-3983HIGHWooCommerce Customers Manager < 30.1 - Bulk Action via CSRFEPSS 0.3%CVE-2024-27969MEDIUMWordPress Free Downloads WooCommerce plugin <= 3.5.8.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-10731MEDIUMReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data ExportEPSS 0.3%CVE-2024-12808MEDIUMWP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSSEPSS 0.3%CVE-2024-6478MEDIUMCTT Expresso para WooCommerce < 3.2.13 - Admin+ Stored XSSEPSS 0.3%CVE-2023-34386MEDIUMWordPress WPC Smart Wishlist for WooCommerce Plugin <= 4.7.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-6718HIGHB1.lt for WooCommerce <= 2.2.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL InjectionEPSS 0.3%CVE-2024-11934MEDIUMFormaloo Form Maker & Customer Analytics for WordPress & WooCommerce <= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-13369MEDIUMPremmerce WooCommerce Customers Manager <= 1.1.14 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-13692MEDIUMReturn Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object ReferenceEPSS 0.3%CVE-2025-14348MEDIUMweMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information DisclosureEPSS 0.3%CVE-2024-6722MEDIUMChatbot Support AI <= 1.0.2 - Admin+ Stored XSSEPSS 0.3%CVE-2026-15647MEDIUMBrands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta FieldEPSS 0.3%CVE-2023-4161MEDIUMWooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field CreationEPSS 0.3%CVE-2023-51480MEDIUMWordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-30492MEDIUMWordPress Minimum Purchase for WooCommerce Plugin <= 2.0.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%