Exposição de WooCommerce

Ecommerce, WordPress plugins
1.859
score de exposição
591.334
sites usam
0
em exploração
159
críticos
Análise Vexday

O WooCommerce acumula 2.037 CVEs catalogadas, volume expressivo que reflete sua ampla adoção e superfície de ataque — das quais 158 são de severidade crítica e 137 surgiram nos últimos 90 dias, indicando ritmo elevado de descoberta recente. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhuma entrada confirmada no momento, embora isso não elimine o risco operacional dado o alto volume de falhas críticas acumuladas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que exige atenção contínua em ambientes com múltiplos plugins e temas integrados. O CVE-2023-28121 merece prioridade imediata: seu score EPSS de 0,87 indica probabilidade muito elevada de exploração ativa nos próximos 30 dias, tornando-o o principal vetor de risco a ser tratado em qualquer plano de remediação.

CVEs

2.053 resultados
CVE-2025-5062MEDIUMWooCommerce <= 9.4.2 - PostMessage-Based Cross-Site ScriptingEPSS 0.4%CVE-2024-13343HIGHWooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationEPSS 0.4%CVE-2024-0434MEDIUMWordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_saveEPSS 0.4%CVE-2020-36748MEDIUMDokan <= 3.0.8 - Cross-Site Request Forgery BypassEPSS 0.4%CVE-2024-10852MEDIUMBuy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings ExportEPSS 0.4%CVE-2025-3906HIGHIntegração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationEPSS 0.4%CVE-2026-10735HIGHShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update ServerEPSS 0.4%CVE-2025-48317HIGHWordPress WooCommerce Payment Gateway for Saferpay Plugin <= 0.4.9 - Path Traversal VulnerabilityEPSS 0.4%CVE-2023-27607MEDIUMWordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Settings Change vulnerabilityEPSS 0.4%CVE-2024-13904MEDIUMPlatform.ly for WooCommerce <= 1.1.6 - Unauthenticated Blind Server-Side Request ForgeryEPSS 0.4%CVE-2023-7068MEDIUMWooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order ExportEPSS 0.4%CVE-2024-56290CRITICALWordPress Multiple Shipping And Billing Address For Woocommerce Plugin <= 1.2 - Unauthenticated SQL Injection vulnerabilityEPSS 0.4%CVE-2024-55992MEDIUMWordPress WooCommerce Basic Ordernumbers plugin <= 1.4.4 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-4040MEDIUMThe Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilitEPSS 0.4%CVE-2024-13540MEDIUMWooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path DsiclosureEPSS 0.4%CVE-2024-9109MEDIUMUPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key resetEPSS 0.4%CVE-2024-10638MEDIUMProduct Labels For Woocommerce < 1.5.11 - Admin+ SQLiEPSS 0.4%CVE-2024-49244HIGHWordPress SV Product Import Export for WooCommerce plugin <= 1.0.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-30470MEDIUMWordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-32803MEDIUMWordPress SuperFaktura WooCommerce plugin <= 1.40.3 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.4%

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →