Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2025-31553CRITICALWordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.1 - SQL Injection vulnerabilityEPSS 0.5%CVE-2024-10729HIGHBooking & Appointment Plugin for WooCommerce <= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option UpdateEPSS 0.5%CVE-2021-42367MEDIUMVariation Swatches for WooCommerce <= 2.1.1 Authenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-3199MEDIUMThe Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.5%CVE-2023-37969MEDIUMWordPress Checkout with Zelle on Woocommerce plugin <= 3.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-5348—Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting UpdateEPSS 0.5%CVE-2024-13553CRITICALSMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege EscalationEPSS 0.5%CVE-2023-52234MEDIUMWordPress Booster Elite for WooCommerce plugin < 7.1.2 - Auth. Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2023-52231MEDIUMWordPress Booster Plus for WooCommerce plugin < 7.1.2 - Auth. Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2023-49825HIGHWordPress Soledad Theme <= 8.4.1 is vulnerable to SQL InjectionEPSS 0.5%CVE-2022-47182MEDIUMWordPress APIExperts Square for WooCommerce plugin <= 4.4.1 - Broken Access ControlEPSS 0.5%CVE-2023-36506MEDIUMWordPress YITH WooCommerce Waitlist plugin <= 2.13.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-32963MEDIUMWordPress Predictive Search for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-11967HIGHMail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File UploadEPSS 0.5%CVE-2022-47168MEDIUMWordPress Printful Integration for WooCommerce plugin <= 2.2.3 - Cross Site Request Forgery (CSRF)EPSS 0.5%CVE-2022-46811MEDIUMWordPress ALD Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 1.0.21 - Broken Access Control + CSRFEPSS 0.5%CVE-2022-46807MEDIUMWordPress Stock Sync for WooCommerce plugin <= 2.3.2 - Broken Access ControlEPSS 0.5%CVE-2024-22135HIGHWordPress Order Export & Order Import for WooCommerce Plugin <= 2.4.3 is vulnerable to Arbitrary File UploadEPSS 0.5%CVE-2024-22152HIGHWordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File UploadEPSS 0.5%CVE-2025-30835HIGHWordPress Accounting for WooCommerce plugin <= 1.6.8 - Local File Inclusion vulnerabilityEPSS 0.5%