Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2023-34004MEDIUMWordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-5020MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryEPSS 0.4%CVE-2024-8872MEDIUMStore Hours for WooCommerce <= 4.3.20 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-8788MEDIUMEU/UK VAT Manager for WooCommerce <= 2.12.12 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-69129CRITICALWordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2025-67945CRITICALWordPress MailerLite – WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-11361MEDIUMPDF Invoices & Packing Slips Generator for WooCommerce <= 2.2.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-60083HIGHWordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerabilityEPSS 0.4%CVE-2024-43315HIGHWordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2026-25397HIGHWordPress File Uploader for WooCommerce plugin <= 1.0.4 - Path Traversal vulnerabilityEPSS 0.4%CVE-2023-4938MEDIUMBEAR <= 1.1.3.3 - Missing Authorization to Product ManipulationEPSS 0.4%CVE-2024-3243MEDIUMCustomer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email SendingEPSS 0.4%CVE-2021-4395MEDIUMAbandoned Cart Recovery for WooCommerce <= 1.0.4 - Cross-Site Request Forgery BypassEPSS 0.4%CVE-2025-60192HIGHWordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60189HIGHWordPress PoloPag – Pix Automático para Woocommerce plugin <= 2.0.9 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60204HIGHWordPress WooCommerce Store Toolkit plugin <= 2.4.3 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-60191HIGHWordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-14070HIGHReviewify <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary WooCommerce Coupon CreationEPSS 0.4%CVE-2025-60194HIGHWordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2024-1697MEDIUMCustom WooCommerce Checkout Fields Editor <= 1.3.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%