Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2024-13696HIGHFlexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name ParameterEPSS 0.4%CVE-2024-38683HIGHWordPress WooCommerce Report plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-38669HIGHWordPress Predictive Search for WooCommerce plugin <= 6.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9237MEDIUMFish and Ships <= 1.5.9 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-39666MEDIUMWordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-4821MEDIUMDrag and Drop Multiple File Upload < 1.1.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-5704MEDIUMXPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Settings UpdateEPSS 0.4%CVE-2024-24800HIGHWordPress Product Feed PRO for WooCommerce plugin <= 13.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-1311MEDIUMWooCommerce Multivendor Marketplace – REST API <= 1.6.2 - Authenticated (Subscriber+) SQL InjectionEPSS 0.4%CVE-2024-1639MEDIUMLicense Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information ExposureEPSS 0.4%CVE-2023-29174MEDIUMWordPress SKU Label Changer For WooCommerce plugin <= 3.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-47660MEDIUMWordPress Product Visibility by Country for WooCommerce Plugin <= 1.4.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47657MEDIUMWordPress Direct Checkout – Quick View – Buy Now For WooCommerce Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47533MEDIUMWordPress Countdown and CountUp, WooCommerce Sales Timer Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-51499MEDIUMWordPress WooCommerce Shipping Per Product plugin <= 2.5.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-54227MEDIUMWordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2022-3763HIGHBooster for WooCommerce - Checkout Files Deletion via CSRFEPSS 0.4%CVE-2023-49827HIGHWordPress Soledad Theme <= 8.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-23495HIGHWordPress WooCommerce Order Search plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9109MEDIUMUPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key resetEPSS 0.4%