Exposición de WooCommerce

Ecommerce, WordPress plugins
1934
score de exposición
591.334
sitios usan
0
en explotación
162
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2074 resultados
CVE-2025-12086MEDIUMReturn Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request CancellationEPSS 0.2%CVE-2025-57905MEDIUMWordPress AgreeMe Checkboxes For WooCommerce Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) VulnerabilityEPSS 0.2%CVE-2025-6214MEDIUMOmnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST EndpointEPSS 0.2%CVE-2025-49042MEDIUMWordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1447MEDIUMMail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-27354MEDIUMWordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67542MEDIUMWordPress Multi-Step Checkout for WooCommerce plugin <= 2.33 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-47633MEDIUMWordPress Awin – Advertiser Tracking for WooCommerce plugin <= 2.0.0 - CSRF to Product Feed Regeneration vulnerabilityEPSS 0.2%CVE-2025-12634MEDIUMRefund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status UpdateEPSS 0.2%CVE-2025-32659HIGHWordPress FraudLabs Pro for WooCommerce plugin <= 2.22.8 - CSRF to Stored XSS vulnerabilityEPSS 0.2%CVE-2025-58856MEDIUMWordPress Woocommerce Notify Updated Product Plugin <= 1.6 - Cross Site Request Forgery (CSRF) VulnerabilityEPSS 0.2%CVE-2025-30854MEDIUMWordPress Serial Codes Generator and Validator with WooCommerce Support plugin <= 2.7.7 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-4479MEDIUMWholeSale Products Dynamic Pricing Management WooCommerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.2%CVE-2026-39508MEDIUMWordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-1362MEDIUMeasy-broken-link-checker <= 9.0.2 - Bulk Actions via CSRFEPSS 0.2%CVE-2026-4140MEDIUMNi WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX ActionEPSS 0.2%CVE-2025-7960MEDIUMKing Addons for Elementor <= 51.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.2%CVE-2025-58985MEDIUMWordPress Additional Custom Product Tabs for WooCommerce Plugin <= 1.7.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-13718MEDIUMFlexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/ModificationEPSS 0.2%CVE-2026-4110MEDIUMUltimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_auctions_bids_listEPSS 0.2%