Exposição de WooCommerce

Ecommerce, WordPress plugins
3.072
score de exposição
553.677
sites usam
0
em exploração
205
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.630 resultados
CVE-2022-46795MEDIUMWordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 4.7.2 - CSRF Plugin Settings Reset vulnerabilityEPSS 0.6%CVE-2022-3995MEDIUMTeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object ReferenceEPSS 0.6%CVE-2023-6090CRITICALWordPress Mollie Payments for WooCommerce Plugin <= 7.3.11 is vulnerable to Arbitrary File UploadEPSS 0.6%CVE-2024-30231CRITICALWordPress Product Import Export for WooCommerce plugin <= 2.4.1 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-8290HIGHWCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege EscalationEPSS 0.6%CVE-2021-4376MEDIUMWooCommerce Multi Currency <= 2.1.17 - Missing AuthorizationEPSS 0.6%CVE-2023-40555HIGHWordPress Flatsome Theme <= 3.17.5 is vulnerable to PHP Object InjectionEPSS 0.6%CVE-2023-52224MEDIUMWordPress Revolut Gateway for WooCommerce plugin <= 4.9.7 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2022-0397—WPC Smart Wishlist for WooCommerce < 2.9.4 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2023-51502HIGHWordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)EPSS 0.6%CVE-2023-37971MEDIUMWordPress WooCommerce Product Stock Alert plugin <= 2.0.1 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2022-45377MEDIUMWordPress Drag and Drop Multiple File Upload for WooCommerce Plugin <= 1.0.8 is vulnerable to Multiple VulnerabilitiesEPSS 0.6%CVE-2022-1469—FiboSearch < 1.18.0 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-2575—WBW Currency Switcher for WooCommerce < 1.6.6 - Admin+ Stored XSSEPSS 0.6%CVE-2023-4423MEDIUMWP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.37.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-31405HIGHWordPress Fami WooCommerce Compare plugin <= 1.0.5 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2026-16062MEDIUMEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ ContentEPSS 0.6%CVE-2024-2203MEDIUMThe Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients WidgetEPSS 0.6%CVE-2024-9944MEDIUMWooCommerce <= 9.0.2 - Unauthenticated HTML InjectionEPSS 0.6%CVE-2025-30879HIGHWordPress MC Woocommerce Wishlist plugin <= 1.8.9 - SQL Injection vulnerabilityEPSS 0.6%