Exposição de WooCommerce

Ecommerce, WordPress plugins
3.083
score de exposição
553.677
sites usam
0
em exploração
207
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.653 resultados
CVE-2023-2450MEDIUMThe FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versionEPSS 0.6%CVE-2022-2518HIGHStockists Manager for Woocommerce <= 1.0.2.1 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-28955HIGHWordPress Easy Video Player Wordpress & WooCommerce plugin <= 10.0 - Arbitrary File Download VulnerabilityEPSS 0.6%CVE-2023-5638MEDIUMBooster for WooCommerce <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2026-9832MEDIUMPayment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook EndpointEPSS 0.6%CVE-2026-22354HIGHWordPress Woocommerce Category Banner Management plugin <= 2.5.1 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2023-25026MEDIUMWordPress PayPal Brasil para WooCommerce plugin <= 1.4.2 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2024-12627HIGHCoupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization to Authenticated (Contributor+) PHP Object InjectionEPSS 0.6%CVE-2024-1047MEDIUMThemeIsle SDK <= Various Versions - Missing AuthorizationEPSS 0.6%CVE-2023-41803MEDIUMWordPress BitPay Checkout for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2023-52215CRITICALWordPress Barcode Scanner with Inventory & Order Manager Plugin <=1.5.1 is vulnerable to SQL InjectionEPSS 0.6%CVE-2026-12736HIGHWPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST EndpointEPSS 0.6%CVE-2023-47244MEDIUMWordPress Email Marketing for WooCommerce by Omnisend Plugin <= 1.13.8 is vulnerable to Sensitive Data ExposureEPSS 0.6%CVE-2024-49658CRITICALWordPress Woocommerce Custom Profile Picture plugin <= 1.0 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-6560MEDIUMAddonify – Quick View For WooCommerce <= 1.2.16 - Unauthenticated Full Path DislcosureEPSS 0.6%CVE-2025-31553CRITICALWordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.1 - SQL Injection vulnerabilityEPSS 0.6%CVE-2024-30230HIGHWordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2026-9662HIGHRecover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' ParameterEPSS 0.6%CVE-2026-11421MEDIUMERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' ParameterEPSS 0.6%CVE-2024-13553CRITICALSMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege EscalationEPSS 0.5%