Exposición de WooCommerce

Ecommerce, WordPress plugins
1882
score de exposición
591.334
sitios usan
0
en explotación
160
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2060 resultados
CVE-2025-12398MEDIUMProduct Table for WooCommerce <= 5.0.8 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2024-43316MEDIUMWordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-10736MEDIUMReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data ManipulationEPSS 0.2%CVE-2025-62091MEDIUMWordPress Serial Codes Generator and Validator with WooCommerce Support plugin <= 2.8.2 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-13774MEDIUMWishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist NameEPSS 0.2%CVE-2024-48047MEDIUMWordPress Linked Variation for WooCommerce plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-26899MEDIUMWordPress Recapture for WooCommerce Plugin <= 1.0.43 - CSRF to Settings Change vulnerabilityEPSS 0.2%CVE-2025-68029MEDIUMWordPress Wallet System for WooCommerce plugin <= 2.7.3 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2025-14875MEDIUMHBLPAY Payment Gateway for WooCommerce <= 5.0.0 - Reflected Cross-Site Scripting via 'cusdata' ParameterEPSS 0.2%CVE-2026-6417MEDIUMGLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'EPSS 0.2%CVE-2025-13137MEDIUMLive Sales Notification for Woocommerce – Woomotiv <= 3.6.3 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2026-32412MEDIUMWordPress Gift Up Gift Cards for WordPress and WooCommerce plugin <= 3.1.7 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2026-39645MEDIUMWordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2025-12389MEDIUMImport Export For WooCommerce <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Settings UpdateEPSS 0.2%CVE-2025-12087MEDIUMWishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item DeletionEPSS 0.2%CVE-2025-64269MEDIUMWordPress WooCommerce PDF Invoice Builder plugin <= 1.2.150 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-2386MEDIUMThe Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'EPSS 0.2%CVE-2022-4363MEDIUMWholesale Market <= 2.2.2 - Settings Update via CSRFEPSS 0.2%CVE-2025-64200MEDIUMWordPress Email Template Customizer for WooCommerce plugin <= 1.2.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-64289MEDIUMWordPress Premmerce Product Search for WooCommerce plugin <= 2.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%