Exposição de WooCommerce

Ecommerce, WordPress plugins
3.083
score de exposição
553.677
sites usam
0
em exploração
207
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.653 resultados
CVE-2026-14289CRITICALWP FacturaONE < 5.37 - Unauthenticated Remote Code ExecutionEPSS 0.7%CVE-2025-39364HIGHWordPress Product Category Slider for WooCommerce plugin <= 4.3.4 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2023-6327MEDIUMShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_productsEPSS 0.7%CVE-2021-39347MEDIUMStripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account HijackingEPSS 0.7%CVE-2026-18442HIGHWCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' ParameterEPSS 0.7%CVE-2023-37972MEDIUMWordPress WooCommerce Product Stock Alert Plugin <= 2.0.1 is vulnerable to Sensitive Data ExposureEPSS 0.7%CVE-2022-2099—WooCommerce < 6.6.0 - Admin+ Stored HTML InjectionEPSS 0.7%CVE-2024-3934MEDIUMMercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File DownloadEPSS 0.7%CVE-2023-4216LOWOrders Tracking for WooCommerce < 1.2.6 - Admin+ Arbitrary File Access/ReadEPSS 0.7%CVE-2023-4603MEDIUMStar CloudPRNT for WooCommerce <= 2.0.3 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2026-115346HIGHAvada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload FieldEPSS 0.7%CVE-2026-15291HIGHChat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information ExposureEPSS 0.7%CVE-2023-35881HIGHWordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerabilityEPSS 0.7%CVE-2024-1668MEDIUMAvada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form EntriesEPSS 0.7%CVE-2022-3537HIGHRole Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File UploadEPSS 0.7%CVE-2021-4347CRITICALAdvanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options ChangeEPSS 0.7%CVE-2024-0610CRITICALPiraeus Bank WooCommerce Payment Gateway <= 1.6.5.1 - Unauthenticated SQL InjectionEPSS 0.7%CVE-2022-36284MEDIUMWordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Authenticated IDOR vulnerability leading to PayPal email changeEPSS 0.7%CVE-2022-0426—Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2025-7654HIGHMultiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel LibraryEPSS 0.6%