Exposição de WooCommerce

Ecommerce, WordPress plugins
3.083
score de exposição
553.677
sites usam
0
em exploração
207
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.653 resultados
CVE-2021-25077—Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2023-2843HIGHMultiParcels Shipping For WooCommerce < 1.14.15 - Subscribers+ SQLiEPSS 0.9%CVE-2026-18080CRITICALERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP AttachmentEPSS 0.9%CVE-2026-18027MEDIUMWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' ParameterEPSS 0.9%CVE-2022-0818—Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSSEPSS 0.9%CVE-2022-1465—WPC Smart Wishlist for WooCommerce < 2.9.9 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2022-1532—Themify - WooCommerce Product Filter < 1.3.8 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2026-15323HIGHProduct Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON UploadEPSS 0.9%CVE-2024-9756MEDIUMOrder Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File UploadEPSS 0.9%CVE-2022-4108MEDIUMWholesale Market for WooCommerce < 1.0.8 - Admin+ Arbitrary File DownloadEPSS 0.9%CVE-2026-93388CRITICALPrintcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_urlEPSS 0.9%CVE-2024-10627CRITICALWooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2024-5335CRITICALUltimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object InjectionEPSS 0.9%CVE-2024-4185HIGHCustomer Email Verification for WooCommerce <= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient RandomnessEPSS 0.9%CVE-2023-0948MEDIUMJapanized For WooCommerce < 2.5.8 - Reflected XSSEPSS 0.9%CVE-2025-4200HIGHZagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File InclusionEPSS 0.8%CVE-2023-35876HIGHWordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)EPSS 0.8%CVE-2024-11423HIGHUltimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money GlitchEPSS 0.8%CVE-2024-2344HIGHAvada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entryEPSS 0.8%CVE-2021-24588—SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site ScriptingEPSS 0.8%