¿Es seguro Woo Order Export Lite?

Qué hace este plugin

• Slug: woo-order-export-lite
• 100000+ instalaciones activas

exportexport ordersorderorder exportwoocommerce

Estado de mantenimiento

• Última versión conocida: 4.1.0
• Requiere PHP: 7.4.0+
• PHP máximo soportado (analizado): <8.0

Vulnerabilidades conocidas

10 CVEs conocidos registrados para Woo Order Export Lite. Reportadas entre 2018 y 2026.

CVE-2026-56042

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with customer-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-11360

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_direction' parameter in all versions up to, and including, 4.0.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The endpoint requires a valid woe_nonce and Shop Manager-level capabilities (view_woocommerce_reports or export_woocommerce_orders), and wp_magic_quotes protection is stripped via stripslashes_deep() before processing, allowing quote and backslash characters to survive intact into the SQL context.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-10828

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-31266

Update the WordPress Advanced Order Export For WooCommerce plugin to the latest available version (at least 3.4.5). movrment discovered and reported this Remote Code Execution (RCE) vulnerability in WordPress Advanced Order Export For WooCommerce Plugin. This could allow a malicious actor to execute commands on the target website. This can be used to gain backdoor access to then take full control of the website. This vulnerability has been fixed in version 3.4.5. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-40128

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on the export download functionality. This makes it possible for unauthenticated attackers to execute this code on behalf of an administrator, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-35275

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘'method' parameter in versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2021-24169

This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2021-27349

Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

+ 2 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2020-11727	Advanced Order Export For WooCommerce [woo-order-export-lite] < 3.1.4	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 3.1.4	3.1.4	2020-04-08	✓ corregido en la última versión
CVE-2018-11525	Advanced Order Export For WooCommerce [woo-order-export-lite] < 1.5.5	Neutralización incorrecta de elementos de fórmula en un archivo CSV (CSV Injection)	Alta 7,8	< 1.5.5	1.5.5	2018-06-19	✓ corregido en la última versión

CVE-2020-11727

The Advanced Order Export plugin for WooCommerce versions < 3.1.4 had a reflected XSS vulnerability due to lack of input sanitization on the woe_post_type parameter. This allowed arbitrary HTML and JavaScript injection and execution in the context of the logged in user.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

CVE-2018-11525

CSV Injection vulnerability found by Bhushan Patil in WordPress Advanced Order Export For WooCommerce plugin (versions <= 1.5.4).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Cómo solucionarlo

Mantén Woo Order Export Lite actualizado — 4.1.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Customizer Export/Import — 100000+ instalaciones activas — 96/100 (115) — PHP máx. 8.4
• WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel — 100000+ instalaciones activas — 90/100 (413) — PHP máx. 8.4
• Export All URLs — 50000+ instalaciones activas — 92/100 (94) — PHP máx. 8.4
• Export media with selected content (by DKZR) — 40000+ instalaciones activas — 90/100 (93) — PHP máx. 8.4
• WP Import Export Lite — 40000+ instalaciones activas — 80/100 (113)