Exposição de WooCommerce

Ecommerce, WordPress plugins
2.608
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.359 resultados
CVE-2024-50494CRITICALWordPress Sudan Payment Gateway for WooCommerce plugin <= 1.2.2 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-13622HIGHFile Uploads Addon for WooCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected DirectoryEPSS 0.5%CVE-2026-14955MEDIUMCheckout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' ParameterEPSS 0.5%CVE-2025-22782CRITICALWordPress WR Price List Manager For Woocommerce plugin <= 1.0.8 - Remote Code Execution (RCE) vulnerabilityEPSS 0.5%CVE-2024-35634MEDIUMWoocommerce – Recent Purchases plugin <= 1.0.1 - File Inclusion vulnerabilityEPSS 0.5%CVE-2025-47649HIGHWordPress Open Close WooCommerce Store plugin <= 4.9.9 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2024-0702HIGHOliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing AuthorizationEPSS 0.5%CVE-2026-12918MEDIUMMail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' ParameterEPSS 0.5%CVE-2024-6000HIGHFooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File UploadEPSS 0.5%CVE-2023-28415MEDIUMWordPress Side Cart Woocommerce (Ajax) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2023-50899MEDIUMWordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 5.0.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2026-12753HIGHAdvance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' ParameterEPSS 0.5%CVE-2024-10519MEDIUMWishlist for WooCommerce: Multi Wishlists Per Customer PRO 3.0.8 - 3.1.2 - Reflected Cross-Site Scripting via wtab ParameterEPSS 0.5%CVE-2023-4423MEDIUMWP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.37.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-50416HIGHWordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.6 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-24799MEDIUMWordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-0870MEDIUMYITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings UpdateEPSS 0.5%CVE-2025-30825HIGHWordPress WPC Smart Linked Products plugin <= 1.3.5 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2024-13925HIGHKlarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive LoggingEPSS 0.5%CVE-2026-22480HIGHWordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerabilityEPSS 0.5%