Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2024-6480MEDIUMSIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) Cross-Site ScriptingEPSS 0.3%CVE-2022-4941MEDIUMWCFM Membership <= 2.9.10 - Cross-Site Request ForgeryEPSS 0.3%CVE-2026-12215MEDIUMOTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute ForceEPSS 0.3%CVE-2026-1748MEDIUMInvoct – PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information ExposureEPSS 0.3%CVE-2024-47367HIGHWordPress YITH WooCommerce Product Add-Ons plugin <= 4.13.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-39559MEDIUMWordPress Bring Fraktguiden for WooCommerce plugin <= 1.11.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-1534MEDIUMBooster for WooCommerce <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortocdeEPSS 0.3%CVE-2024-1057MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2023-6892MEDIUMEAN for WooCommerce <= 4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta ShortcodeEPSS 0.3%CVE-2025-47526MEDIUMWordPress GS Variation Swatches for WooCommerce plugin <= 3.0.4 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-24762MEDIUMWordPress TicketBAI Facturas para WooCommerce plugin <= 3.45 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-47602MEDIUMWordPress Calculate Prices based on Distance For WooCommerce plugin <= 1.3.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-47472MEDIUMWordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2026-0942MEDIUMRede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs DeletionEPSS 0.3%CVE-2025-31000MEDIUMWordPress Payment QR WooCommerce plugin <= 1.1.6 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-49320MEDIUMWordPress FraudLabs Pro for WooCommerce plugin <= 2.22.11 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-46244MEDIUMWordPress Advanced Linked Variations for Woocommerce plugin <= 1.0.3 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-29006MEDIUMWordPress Direct Checkout for WooCommerce Lite plugin <= 1.0.3 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-25929MEDIUMWordPress Product Catalog Mode For Woocommerce plugin <= 5.0.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-1756MEDIUMWooCommerce Customers Manager < 29.8 - Subscriber+ Email DisclosureEPSS 0.3%