Exposición de WooCommerce

Ecommerce, WordPress plugins
2628
score de exposición
568.489
sitios usan
0
en explotación
186
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2368 resultados
CVE-2025-2302MEDIUMAdvanced Woo Search <= 3.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via aws_search_terms ShortcodeEPSS 0.3%CVE-2025-8617MEDIUMYITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view ShortcodeEPSS 0.3%CVE-2023-48768MEDIUMWordPress Quantity Plus Minus Button for WooCommerce by CodeAstrology Plugin <= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2024-47395HIGHWordPress Robokassa payment gateway for Woocommerce plugin <= 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-60247MEDIUMWordPress Bux Woocommerce plugin <= 1.2.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-56023MEDIUMWordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57632MEDIUMWordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-61958MEDIUMWordPress License Manager for WooCommerce plugin <= 3.0.17 - Arbitrary Content Deletion vulnerabilityEPSS 0.3%CVE-2026-12393MEDIUMWPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOREPSS 0.3%CVE-2026-15398MEDIUMEventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket RedemptionEPSS 0.3%CVE-2023-52222MEDIUMWordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-11727HIGHOmnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-73345HIGHWordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-5720MEDIUMCustomer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via `author` ParameterEPSS 0.3%CVE-2026-3355MEDIUMCustomer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch'EPSS 0.3%CVE-2026-6417MEDIUMGLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'EPSS 0.3%CVE-2024-56272MEDIUMWordPress Hide Category by User Role for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-43838MEDIUMWordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change VulnerabilityEPSS 0.3%CVE-2024-12214MEDIUMWooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink ParameterEPSS 0.3%CVE-2025-12039MEDIUMBigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() ExposureEPSS 0.3%