Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2023-40327MEDIUMWordPress Putler Connector for WooCommerce plugin <= 2.12.0 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-50834MEDIUMWordPress WooCommerce Menu Extension Plugin <= 1.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-10168MEDIUMActive Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button ShortcodeEPSS 0.3%CVE-2025-14977HIGHDokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information DisclosureEPSS 0.3%CVE-2024-43126HIGHWordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.6.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43127HIGHWordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.11 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12448MEDIUMPosts and Products Views for WooCommerce <= 2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2022-43491MEDIUMWordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.3%CVE-2025-49998MEDIUMWordPress WooCommerce Fortnox Integration plugin <= 4.5.5 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-66071MEDIUMWordPress Custom Order Numbers for WooCommerce plugin <= 1.11.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-31406MEDIUMWordPress ELEX WooCommerce Request a Quote plugin <= 2.3.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2023-52179MEDIUMWordPress Product Expiry for WooCommerce plugin <= 2.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-0554MEDIUMNotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics ResetEPSS 0.3%CVE-2026-13329MEDIUMWC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order RefundEPSS 0.3%CVE-2025-6717MEDIUMB1.lt for WooCommerce <= 2.2.56 - Authenticated (Subscriber+) SQL InjectionEPSS 0.3%CVE-2026-57419MEDIUMWordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-18603MEDIUMCancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX ActionsEPSS 0.3%CVE-2026-73363MEDIUMWordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-75861MEDIUMUltimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized RedemptionEPSS 0.3%CVE-2024-11809MEDIUMPrimer MyData for Woocommerce <= 4.2.1 - Reflected Cross-Site ScriptingEPSS 0.3%