Exposição de WooCommerce

Ecommerce, WordPress plugins
2.608
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.359 resultados
CVE-2025-47461HIGHWordPress Subaccounts for WooCommerce plugin <= 1.6.6 - Account Takeover vulnerabilityEPSS 0.5%CVE-2023-50831MEDIUMWordPress CURCY Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2024-2343MEDIUMAvada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_actionEPSS 0.5%CVE-2024-1119MEDIUMOrder Tip for WooCommerce <= 1.3.1 - Missing Authorization to Unauthenticated Data ExportEPSS 0.5%CVE-2023-37969MEDIUMWordPress Checkout with Zelle on Woocommerce plugin <= 3.1 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-0479MEDIUMPrint Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS EPSS 0.5%CVE-2026-76009HIGHNext-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration EndpointEPSS 0.5%CVE-2025-24594MEDIUMWordPress Linet ERP-Woocommerce Integration plugin <= 3.5.7 - CSRF to Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-49060CRITICALWordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2024-1677MEDIUMPrint Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Improper AuthorizationEPSS 0.5%CVE-2024-11725HIGHSMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options UpdateEPSS 0.5%CVE-2022-47182MEDIUMWordPress APIExperts Square for WooCommerce plugin <= 4.4.1 - Broken Access ControlEPSS 0.5%CVE-2023-36506MEDIUMWordPress YITH WooCommerce Waitlist plugin <= 2.13.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-32963MEDIUMWordPress Predictive Search for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-6353HIGHWallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'EPSS 0.5%CVE-2023-0405MEDIUMGPT3 AI Content Writer < 1.4.38 - Subscriber+ Arbitrary Post Content UpdateEPSS 0.5%CVE-2022-47168MEDIUMWordPress Printful Integration for WooCommerce plugin <= 2.2.3 - Cross Site Request Forgery (CSRF)EPSS 0.5%CVE-2022-46811MEDIUMWordPress ALD Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 1.0.21 - Broken Access Control + CSRFEPSS 0.5%CVE-2022-46807MEDIUMWordPress Stock Sync for WooCommerce plugin <= 2.3.2 - Broken Access ControlEPSS 0.5%CVE-2024-52379CRITICALWordPress kineticPay for WooCommerce plugin <= 2.0.8 - Arbitrary File Upload vulnerabilityEPSS 0.5%