Exposición de WooCommerce

Ecommerce, WordPress plugins
2301
score de exposición
571.531
sitios usan
0
en explotación
170
críticos
Análisis Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2221 resultados
CVE-2023-2744—WP ERP < 1.12.4 - Admin+ SQL InjectionEPSS 2.6%CVE-2022-33901MEDIUMWordPress MultiSafepay plugin for WooCommerce plugin <= 4.13.1 - Unauthenticated Arbitrary File Read vulnerabilityEPSS 2.6%CVE-2022-0149—WooCommerce – Store Exporter < 2.7.1 - Reflected Cross-Site Scripting (XSS)EPSS 2.3%CVE-2024-9186HIGHAutomation By Autonami < 3.3.0 - Unauthenticated SQLiEPSS 2.3%CVE-2024-13346HIGHAvada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 2.3%CVE-2025-13339HIGHHippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File ReadEPSS 2.2%CVE-2025-4403CRITICALDrag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload FunctionEPSS 2.1%CVE-2022-4939CRITICALWCFM Membership <= 2.10.0 - Unauthenticated Privilege EscalationEPSS 2.1%CVE-2021-24171—WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File UploadEPSS 1.9%CVE-2022-1916—Active Products Tables for WooCommerce < 1.0.5 - Reflected Cross-Site-ScriptingEPSS 1.9%CVE-2025-10897HIGHWooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File ReadEPSS 1.8%CVE-2022-0234—WOOCS < 1.3.7.5 - Reflected Cross-Site ScriptingEPSS 1.8%CVE-2023-2706HIGHOTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege EscalationEPSS 1.7%CVE-2022-1953—Product Configurator for WooCommerce < 1.2.32 - Unauthenticated Arbitrary File DeletionEPSS 1.7%CVE-2026-49777CRITICALWordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerabilityEPSS 1.7%CVE-2021-25085—WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site ScriptingEPSS 1.7%CVE-2024-8277CRITICALWooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege EscalationEPSS 1.6%CVE-2025-2941CRITICALDrag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File MoveEPSS 1.6%CVE-2022-1933—CDI < 5.1.9 - Reflected Cross-Site-ScriptingEPSS 1.6%CVE-2022-0478—Event Manager for WooCommerce < 3.5.8 - Contributor+ SQL InjectionEPSS 1.5%