Exposição de WooCommerce

Ecommerce, WordPress plugins
3.069
score de exposição
553.677
sites usam
0
em exploração
205
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.627 resultados
CVE-2024-3962CRITICALProduct Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_fileEPSS 1.4%CVE-2026-17581HIGHWCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template EngineEPSS 1.4%CVE-2021-24846—Ni WooCommerce Custom Order Status < 1.9.7 - Subscriber+ SQL InjectionEPSS 1.4%CVE-2019-25152HIGHAbandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site ScriptingEPSS 1.4%CVE-2024-50509HIGHWordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerabilityEPSS 1.4%CVE-2020-36731HIGHFlexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings UpdateEPSS 1.3%CVE-2021-24835—WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-24190—WooCommerce Conditional Marketing Mailer < 1.5.2 - Arbitrary Plugin Installation/Activation via Low Privilege UserEPSS 1.3%CVE-2026-14323HIGHPrintcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' ParametersEPSS 1.3%CVE-2021-24952—Conversios.io < 4.6.2 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-25068—Sync WooCommerce Product feed to Google Shopping <= 1.2.4 - Admin+ SQLiEPSS 1.3%CVE-2024-1205HIGHManagement App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.3%CVE-2024-1986HIGHElite Booster for WooCommerce <= 7.1.7 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.3%CVE-2021-4208—ExportFeed <= 2.0.1.0 - Admin+ SQL InjectionEPSS 1.3%CVE-2021-4337HIGHMultiple XforWooCommerce Add-On Plugins (Various Versions) - Missing AuthorizationEPSS 1.3%CVE-2021-32790MEDIUMBlind SQL Injection possible via Authenticated Web-hook Search API EndpointEPSS 1.3%CVE-2024-8289CRITICALMultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account TakeoverEPSS 1.3%CVE-2022-0989—NS WooCommerce Watermark <= 2.11.3 - Abuse of FunctionalityEPSS 1.2%CVE-2025-4564CRITICALTicketBAI Facturas para WooCommerce <= 3.18 - Unauthenticated Arbitrary File DeletionEPSS 1.2%CVE-2022-3490HIGHCheckout Field Editor for WooCommerce < 1.8.0 - Admin+ PHP Object InjectionEPSS 1.2%