Exposição de WooCommerce

Ecommerce, WordPress plugins
2.628
score de exposição
568.489
sites usam
0
em exploração
186
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.368 resultados
CVE-2024-25930MEDIUMWordPress Custom Order Statuses for WooCommerce Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-51523MEDIUMWordPress WooCommerce Easy Duplicate Product plugin <= 0.3.0.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2022-47181MEDIUMWordPress Email Templates Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-60159MEDIUMWordPress Nota Fiscal Eletrônica WooCommerce plugin <= 3.4.0.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-13708HIGHBooster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-15380HIGHNotificationX <= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview'EPSS 0.3%CVE-2024-56228HIGHWordPress Wishlist for WooCommerce: Multi Wishlists Per Customer plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47487HIGHWordPress MC Woocommerce Wishlist plugin <= 1.9.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-12375MEDIUMPrintful Integration for WooCommerce <= 2.2.11 - Authenticated (Contributor+) Server-Side Request ForgeryEPSS 0.3%CVE-2024-13362MEDIUMFreemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url ParameterEPSS 0.3%CVE-2024-49288MEDIUMWordPress Email Template Customizer for WooCommerce plugin <= 1.2.9.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43986MEDIUMWordPress E-cab taxi booking manager plugin <=1.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43960MEDIUMWordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44046MEDIUMWordPress Themify plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37522MEDIUMWordPress CC & BCC for Woocommerce Order Emails plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12427MEDIUMYITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist RenameEPSS 0.3%CVE-2025-11237MEDIUMMake Email Customizer for WooCommerce <= 1.0.6 - Subscriber+ Arbitrary Options UpdateEPSS 0.3%CVE-2024-24837MEDIUMCross-Site Request Forgery (CSRF) vulnerability in FG PrestaShop, FG Drupal and FG Joomla WordPress pluginsEPSS 0.3%CVE-2025-1284MEDIUMWoocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information DisclosureEPSS 0.3%CVE-2025-24780HIGHWordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection VulnerabilityEPSS 0.3%