Vulnerabilities in WooCommerce
51 resultsVexday analysis
WooCommerce apresenta 42 vulnerabilidades catalogadas, com apenas 2 críticas e nenhuma sob exploração ativa conhecida, indicando risco moderado e controlável. A fraqueza dominante é a falta de proteção CSRF (CWE-352), padrão em plataformas web que requer validação de tokens. O risco é estável, com apenas 1 CVE publicada nos últimos 90 dias.
CVE-2026-1710MEDIUMWooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajaxEPSS 0.3%CVE-2023-35880MEDIUMWordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-47789MEDIUMWordPress WooCommerce Canada Post Shipping Plugin <= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-13457HIGHWooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_idEPSS 0.3%CVE-2023-36511MEDIUMWordPress WooCommerce Order Barcodes Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-47787MEDIUMWordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2023-36513MEDIUMWordPress AutomateWoo Plugin <= 5.7.5 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2023-33316MEDIUMWordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2025-14073MEDIUMWooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information DisclosureEPSS 0.2%CVE-2023-44999MEDIUMWordPress WooCommerce Stripe Gateway plugin <= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2020-36841MEDIUMWooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon CreationEPSS 0.2%