Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2019-25150HIGHEmail Templates <= 1.3 - HTML InjectionEPSS 1.2%CVE-2023-3162CRITICALStripe Payment Plugin for WooCommerce <= 3.7.7 - Authentication BypassEPSS 1.2%CVE-2021-24991—WooCommerce PDF Invoices & Packing Slips < 2.10.5 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2023-2781HIGHUser Email Verification for WooCommerce <= 3.5.0 - Authentication BypassEPSS 1.2%CVE-2021-42363MEDIUMPreview E-Mails for WooCommerce <= 1.6.8 Reflected Cross-Site ScriptingEPSS 1.2%CVE-2026-9725CRITICALPrintcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File DeletionEPSS 1.2%CVE-2024-0683HIGHBulgarisation for WooCommerce <= 3.0.14 - Missing AuthorizationEPSS 1.2%CVE-2024-1950HIGHProduct Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.7 - Authenticated(Contributor+) PHP Object InjectionEPSS 1.2%CVE-2022-3490HIGHCheckout Field Editor for WooCommerce < 1.8.0 - Admin+ PHP Object InjectionEPSS 1.2%CVE-2024-9821HIGHBot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication BypassEPSS 1.2%CVE-2024-1468HIGHAvada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File UploadEPSS 1.2%CVE-2025-4564CRITICALTicketBAI Facturas para WooCommerce <= 3.18 - Unauthenticated Arbitrary File DeletionEPSS 1.1%CVE-2020-36725HIGHTI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options UpdateEPSS 1.1%CVE-2022-50972CRITICALWooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.phpEPSS 1.1%CVE-2023-6979HIGHCustomer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File UploadEPSS 1.1%CVE-2024-54383CRITICALWordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerabilityEPSS 1.1%CVE-2023-0080HIGHCustomer Reviews for WooCommerce < 5.16.0 - Contributor+ LFIEPSS 1.1%CVE-2025-47608CRITICALWordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection VulnerabilityEPSS 1.1%CVE-2024-34370HIGHWordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 1.1%CVE-2023-2276CRITICALWCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 1.1%