Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2026-16739MEDIUMEpeken All Kurir <= 2.1.4 - Unauthenticated Order Payment Confirmation ForgeryEPSS 0.3%CVE-2026-11782MEDIUMPoints and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOREPSS 0.3%CVE-2025-14895MEDIUMPopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data DeletionEPSS 0.3%CVE-2025-12545MEDIUMPixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information ExposureEPSS 0.3%CVE-2025-57917MEDIUMWordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-4101MEDIUMMultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post DeletionEPSS 0.3%CVE-2022-47164MEDIUMWordPress Event Manager for WooCommerce Plugin <= 3.7.7 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-64222HIGHWordPress WooCommerce Recover Abandoned Cart plugin <= 24.6.0 - Arbitrary Content Deletion vulnerabilityEPSS 0.3%CVE-2026-0692HIGHBlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status ManipulationEPSS 0.3%CVE-2024-6458MEDIUMWooCommerce Product Table Lite <= 3.5.1 - Missing Authorization to (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-14436HIGHBrevo for WooCommerce <= 4.0.49 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-12337MEDIUMShipping via Planzer for WooCommerce <= 1.0.25 - Reflected Cross-Site Scripting via processed-idsEPSS 0.3%CVE-2023-35917MEDIUMWordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-69385MEDIUMWordPress Cartify - WooCommerce Gutenberg WordPress Theme theme <= 1.3 - Arbitrary Content Deletion vulnerabilityEPSS 0.3%CVE-2025-58656MEDIUMWordPress Estonian Shipping Methods for WooCommerce Plugin <= 1.7.2 - Sensitive Data Exposure VulnerabilityEPSS 0.3%CVE-2024-10711HIGHWooCommerce Report <= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options UpdateEPSS 0.3%CVE-2026-84849MEDIUMWordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerabilityEPSS 0.3%CVE-2025-5238MEDIUMYITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2025-11269MEDIUMProduct Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings UpdateEPSS 0.3%CVE-2023-3764MEDIUMWooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery via SaveEPSS 0.3%