Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2024-6799MEDIUMYITH Essential Kit for WooCommerce #1 <= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and DeactivationEPSS 0.3%CVE-2024-12109MEDIUMProduct Labels For Woocommerce < 1.5.9 - Admin+ SQLiEPSS 0.3%CVE-2025-47645HIGHWordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.4.9 - Subscriber+ SQL Injection vulnerabilityEPSS 0.3%CVE-2024-9178MEDIUMXT Floating Cart for WooCommerce <= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-6575MEDIUMThe Plus Addons for Elementor <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll WidgetEPSS 0.3%CVE-2024-5192MEDIUMFunnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.3%CVE-2024-35680MEDIUMWordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-27329MEDIUMWordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2024-12781MEDIUMAurum - WordPress & WooCommerce Shopping Theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content ImportEPSS 0.3%CVE-2026-49071MEDIUMWordPress WooCommerce Dropshipping plugin <= 5.2.4 - Broken Authentication vulnerabilityEPSS 0.3%CVE-2024-12278HIGHBooster for WooCommerce <= 7.2.4 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-8678MEDIUMRevolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status UpdateEPSS 0.3%CVE-2023-6494MEDIUMWPC Smart Quick View for WooCommerce <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-6447MEDIUMCall for Price for WooCommerce <= 4.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label SettingsEPSS 0.3%CVE-2026-3574MEDIUMExperto Dashboard for WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' SettingEPSS 0.3%CVE-2025-7820HIGHSKT PayPal for WooCommerce <= 1.4 - Unauthenticated Payment BypassEPSS 0.3%CVE-2025-11735HIGHHUSKY – Products Filter Professional for WooCommerce <= 1.3.7.1 - Unauthenticated SQL Injection via `phrase` ParameterEPSS 0.3%CVE-2026-84045MEDIUME-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cartEPSS 0.3%CVE-2026-28132MEDIUMWordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-16067MEDIUMEvent Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket PriceEPSS 0.3%