Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2024-31117MEDIUMWordPress WooCommerce Bookings Calendar plugin <= 1.0.36 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-25455MEDIUMWordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-2946MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code WidgetEPSS 0.3%CVE-2024-1054MEDIUMBooster for WooCommerce <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-12500MEDIUMCheckout Field Manager (Checkout Manager) for WooCommerce <= 7.8.1 - Unauthenticated Limited File UploadEPSS 0.3%CVE-2025-13440MEDIUMPremmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist DeletionEPSS 0.3%CVE-2024-33585MEDIUMWordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 2.12.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-7067MEDIUMShopLentor <= 2.8.1 - Improper Authorization via woolentor_template_storeEPSS 0.3%CVE-2022-4017HIGHBooster for WooCommerce - Multiple CSRFEPSS 0.3%CVE-2025-49265HIGHWordPress Membership For WooCommerce plugin <= 2.8.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2023-52232MEDIUMWordPress Booster Plus for WooCommerce plugin < 7.1.2 - Authenticated Arbitrary Post/Page Deletion VulnerabilityEPSS 0.3%CVE-2024-12384MEDIUMBinary MLM Woocommerce <= 2.0 - Reflected Cross-Site Scripting via 'page'EPSS 0.3%CVE-2024-32834MEDIUMWordPress WooCommerce Shipping Label plugin <= 2.3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-68022HIGHWordPress Plugin BlueX for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57332HIGHWordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-32585MEDIUMWordPress Import Content in WordPress & WooCommerce with Excel plugin <= 4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-53213CRITICALWordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Arbitrary File Upload VulnerabilityEPSS 0.3%CVE-2025-13457HIGHWooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_idEPSS 0.3%CVE-2023-2179MEDIUMWooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status UpdateEPSS 0.3%CVE-2025-27001MEDIUMWordPress Shipmondo – A complete shipping solution for WooCommerce plugin <= 5.0.3 - Authenticated Arbitrary WordPress Option Disclosure vulnerabilityEPSS 0.3%