Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2026-1988HIGHFlexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode AttributeEPSS 0.8%CVE-2021-4379MEDIUMWooCommerce Multi Currency <= 2.1.17 - Missing AuthorizationEPSS 0.8%CVE-2021-24938—WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-41623HIGHWordPress ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 - Sensitive Data Exposure vulnerabilityEPSS 0.8%CVE-2022-46809MEDIUMWordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV InjectionEPSS 0.8%CVE-2024-12313HIGHCompare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object InjectionEPSS 0.8%CVE-2022-1673—WooCommerce Green Wallet Gateway < 1.0.2 - Reflected Cross Site Scripting in checkout pageEPSS 0.8%CVE-2022-1470—Ultimate WooCommerce CSV Importer <= 2.0 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-11423HIGHUltimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money GlitchEPSS 0.8%CVE-2024-13513CRITICALOliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege EscalationEPSS 0.8%CVE-2024-1173HIGHWP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL InjectionEPSS 0.8%CVE-2025-32631HIGHWordPress Oxygen MyData for WooCommerce plugin <= 1.0.64 - Arbitrary File Deletion vulnerabilityEPSS 0.8%CVE-2023-47777MEDIUMWordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2025-1769MEDIUMProduct Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file FunctionEPSS 0.8%CVE-2024-7258HIGHWooCommerce Google Feed Manager <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File DeletionEPSS 0.8%CVE-2022-2090—Woo Discount Rules < 2.4.2 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-1546—WooCommerce - Product Importer <= 1.5.2 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-10804HIGHUltimate Video Player <= 10.0 - Unauthenticated Arbitrary File DownloadEPSS 0.8%CVE-2024-6027CRITICALThemify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions ParameterEPSS 0.8%CVE-2023-3525HIGHThe Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' EPSS 0.8%