Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2025-22363MEDIUMWordPress Allada T-shirt Designer for Woocommerce plugin <= 1.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2022-45068MEDIUMWordPress Mercado Pago payments for WooCommerce Plugin <= 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-14059MEDIUMEmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path TraversalEPSS 0.3%CVE-2024-11814MEDIUMAdditional Custom Order Status for WooCommerce <= 1.6.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-12257MEDIUMCardGate Payments for WooCommerce <= 3.2.1 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-13389MEDIUMAdmin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information DisclosureEPSS 0.3%CVE-2026-14853MEDIUMWooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing AuthorizationEPSS 0.3%CVE-2026-24993CRITICALWordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.3 - SQL Injection vulnerabilityEPSS 0.3%CVE-2024-12334MEDIUMWC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.4 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-7491MEDIUMHUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to UnsubscribeEPSS 0.3%CVE-2025-12783MEDIUMPremmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings UpdateEPSS 0.3%CVE-2025-24574HIGHWordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-8089HIGHweMail < 2.1.3 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-13725HIGHDynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjaxEPSS 0.3%CVE-2025-68011HIGHWordPress GLS Shipping for WooCommerce plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3775MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL ParameterEPSS 0.3%CVE-2024-43128MEDIUMWordPress WooCommerce Product Table Lite plugin <= 3.5.1 - Arbitrary Code Execution vulnerabilityEPSS 0.3%CVE-2025-58247MEDIUMWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-56265HIGHWordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23481HIGHWordPress Ni WooCommerce Sales Report Email plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%