Exposição de WooCommerce

Ecommerce, WordPress plugins
3.083
score de exposição
553.677
sites usam
0
em exploração
207
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.653 resultados
CVE-2024-1468HIGHAvada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File UploadEPSS 1.2%CVE-2026-10196CRITICALMail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form FieldsEPSS 1.1%CVE-2026-15406HIGHEventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' ParameterEPSS 1.1%CVE-2026-8778CRITICALMIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File UploadEPSS 1.1%CVE-2020-36725HIGHTI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options UpdateEPSS 1.1%CVE-2022-50972CRITICALWooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.phpEPSS 1.1%CVE-2023-6979HIGHCustomer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File UploadEPSS 1.1%CVE-2025-6441CRITICALWebinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition <= 4.03.32 - Unauthenticated Login Token Generation to Authentication BypassEPSS 1.1%CVE-2023-0080HIGHCustomer Reviews for WooCommerce < 5.16.0 - Contributor+ LFIEPSS 1.1%CVE-2022-34868HIGHWordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerabilityEPSS 1.1%CVE-2024-34370HIGHWordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerabilityEPSS 1.1%CVE-2023-2276CRITICALWCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 1.1%CVE-2023-5601CRITICALWooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File UploadEPSS 1.1%CVE-2022-4940HIGHWCFM Membership <= 2.10.0 - Missing AuthorizationEPSS 1.1%CVE-2020-36696HIGHProduct Input Fields for WooCommerce <= 1.2.6 - Missing AuthorizationEPSS 1.1%CVE-2024-8030CRITICALUltimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.0.3 - Unauthenticated PHP Object InjectionEPSS 1.1%CVE-2026-0692HIGHBlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status ManipulationEPSS 1.1%CVE-2024-12152HIGHMIPL WC Multisite Sync <= 1.1.5 - Unauthenticated Arbitrary File DownloadEPSS 1.1%CVE-2024-50508HIGHWordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerabilityEPSS 1.1%CVE-2024-50482CRITICALWordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerabilityEPSS 1.1%