Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2025-7654HIGHMultiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel LibraryEPSS 0.6%CVE-2025-30772HIGHWordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 0.6%CVE-2024-13538MEDIUMBigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path DisclosuteEPSS 0.6%CVE-2025-47569CRITICALWordPress WooCommerce Ultimate Gift Card plugin <= 2.9.6 - SQL Injection vulnerabilityEPSS 0.6%CVE-2026-2296HIGHProduct Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' ParameterEPSS 0.6%CVE-2024-9944MEDIUMWooCommerce <= 9.0.2 - Unauthenticated HTML InjectionEPSS 0.6%CVE-2025-10412CRITICALProduct Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.55 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file'EPSS 0.6%CVE-2023-40002MEDIUMWordPress Booster for WooCommerce Plugin <= 7.1.1 is vulnerable to Sensitive Data ExposureEPSS 0.6%CVE-2024-12402CRITICALThemes Coder – Create Android & iOS Apps For Your Woocommerce Site <= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege EscalationEPSS 0.6%CVE-2023-35049HIGHWordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.6%CVE-2018-25325HIGHWoocommerce CSV Importer 3.3.6 Path Traversal File DeletionEPSS 0.6%CVE-2025-11722HIGHCategory and Products Accordion Panel <= 1.0 - Authenticated (Contributor+) Local File InclusionEPSS 0.6%CVE-2024-7503CRITICALWooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account TakeoverEPSS 0.6%CVE-2024-0913HIGHWP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL InjectionEPSS 0.6%CVE-2025-39557CRITICALWordPress Kadence WooCommerce Email Designer plugin <= 1.5.14 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2026-18391CRITICALWooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object InjectionEPSS 0.6%CVE-2024-10899HIGHWooCommerce Product Table Lite <= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site ScriptingEPSS 0.6%CVE-2024-10792MEDIUMEasiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2021-24974—Product Feed PRO for WooCommerce < 11.0.7 - Subscriber+ Settings Update to Stored XSSEPSS 0.6%CVE-2022-46795MEDIUMWordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 4.7.2 - CSRF Plugin Settings Reset vulnerabilityEPSS 0.6%