- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 09/14/2026, Facebook recorded 3 security vulnerabilities in the last 90 days across 3 products, including 3 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Facebook for WooCommerce had the most security vulnerabilities in the Facebook ecosystem, with 1 vulnerabilities—approximately 33.33% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-66707WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot known exploited | FixYes | Affected productFacebook for WooCommerce | Published08/06/2026 | SeverityHigh |
CVE-2026-66705WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot known exploited | FixYes | Affected productFacebook for WordPress | Published08/06/2026 | SeverityHigh |
CVE-2026-44909 | Exploitation statusNot known exploited | FixYes | Affected productProxygen | Published07/23/2026 | SeverityHigh |
CVE-2026-49059WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability | Exploitation statusNot known exploited | FixYes | Affected productFacebook for WooCommerce | Published05/27/2026 | SeverityMedium |
CVE-2026-23870 | Exploitation statusNot known exploited | FixYes | Affected productreact-server-dom-turbopack | Published05/06/2026 | SeverityHigh |
CVE-2026-23866 | Exploitation statusNot known exploited | FixYes | Affected productWhatsApp for Android | Published05/01/2026 | SeverityMedium |
CVE-2026-23863 | Exploitation statusNot known exploited | FixYes | Affected productWhatsApp Desktop for Windows | Published05/01/2026 | SeverityMedium |
CVE-2026-23864 | Exploitation statusNot known exploited | FixYes | Affected productreact-server-dom-webpack | Published01/26/2026 | SeverityHigh |
CVE-2025-67779 | Exploitation statusNot known exploited | FixYes | Affected productreact-server-dom-parcel | Published12/11/2025 | SeverityHigh |
CVE-2025-55184 | Exploitation statusPublic exploit | FixYes | Affected productreact-server-dom-webpack | Published12/11/2025 | SeverityHigh |
CVE-2025-55183 | Exploitation statusPublic exploit | FixYes | Affected productreact-server-dom-webpack | Published12/11/2025 | SeverityMedium |
CVE-2025-55182 | Exploitation statusKEV | FixYes | Affected productreact-server-dom-webpack | Published12/03/2025 | SeverityCritical |
CVE-2025-55181 | Exploitation statusNot known exploited | FixYes | Affected productProxygen | Published12/02/2025 | SeverityMedium |
CVE-2025-55179 | Exploitation statusNot known exploited | FixYes | Affected productWhatsApp Business for iOS | Published11/18/2025 | SeverityMedium |
CVE-2025-64296WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability | Exploitation statusNot known exploited | FixYes | Affected productFacebook for WooCommerce | Published10/29/2025 | SeverityMedium |
CVE-2025-55177 | Exploitation statusKEV | FixYes | Affected productWhatsApp Desktop for Mac | Published08/29/2025 | SeverityMedium |
CVE-2025-30403 | Exploitation statusNot known exploited | FixYes | Affected productmvfst | Published07/11/2025 | SeverityHigh |
CVE-2025-30401 | Exploitation statusNot known exploited | FixYes | Affected productWhatsApp Desktop for Windows | Published04/05/2025 | SeverityMedium |
CVE-2025-27591 | Exploitation statusNot known exploited | FixYes | Affected productbelow | Published03/11/2025 | SeverityMedium |
CVE-2020-36838Facebook Chat Plugin <= 1.5 - Missing Capabilities Check | Exploitation statusNot known exploited | FixYes | Affected productFacebook Chat Plugin – Live Chat Plugin for WordPress | Published10/16/2024 | SeverityHigh |
CVE-2024-45863 | Exploitation statusNot known exploited | FixYes | Affected productFacebook Thrift | Published09/27/2024 | SeverityMedium |
CVE-2024-45773 | Exploitation statusNot known exploited | FixYes | Affected productFacebook Thrift | Published09/27/2024 | SeverityHigh |
CVE-2024-23347 | Exploitation statusNot known exploited | FixYes | Affected productMeta Spark Studio | Published01/16/2024 | SeverityHigh |
CVE-2023-49062 | Exploitation statusNot confirmed | FixYes | Affected productKatran | Published11/28/2023 | SeverityUnknown |
CVE-2023-5654 | Exploitation statusPublic exploit | FixNot confirmed | Affected productReact Developer Tools Extension | Published10/19/2023 | SeverityMedium |
CVE-2023-44487 | Exploitation statusKEV | FixNot confirmed | Affected productNot confirmed | Published10/10/2023 | SeverityHigh |
CVE-2023-45239 | Exploitation statusNot known exploited | FixYes | Affected producttac_plus | Published10/06/2023 | SeverityUnknown |
CVE-2023-38538 | Exploitation statusNot known exploited | FixYes | Affected productWhatsApp Desktop for Mac | Published10/04/2023 | SeverityMedium |
CVE-2023-38537 | Exploitation statusNot known exploited | FixYes | Affected productWhatsApp Desktop for Mac | Published10/04/2023 | SeverityMedium |
CVE-2023-30470 | Exploitation statusNot known exploited | FixYes | Affected productHermes | Published05/18/2023 | SeverityCritical |
CVE-2023-28753 | Exploitation statusNot known exploited | FixYes | Affected productnetconsd | Published05/18/2023 | SeverityCritical |
CVE-2023-28081 | Exploitation statusNot known exploited | FixYes | Affected productHermes | Published05/18/2023 | SeverityCritical |
CVE-2023-25933 | Exploitation statusNot known exploited | FixYes | Affected productHermes | Published05/18/2023 | SeverityCritical |
CVE-2023-24833 | Exploitation statusNot known exploited | FixYes | Affected productHermes | Published05/18/2023 | SeverityHigh |
CVE-2023-24832 | Exploitation statusNot known exploited | FixYes | Affected productHermes | Published05/18/2023 | SeverityHigh |
CVE-2023-23759 | Exploitation statusNot known exploited | FixYes | Affected productfizz | Published05/18/2023 | SeverityHigh |
CVE-2023-23557 | Exploitation statusNot known exploited | FixYes | Affected productHermes | Published05/18/2023 | SeverityCritical |
CVE-2023-23556 | Exploitation statusNot known exploited | FixYes | Affected productHermes | Published05/18/2023 | SeverityCritical |
CVE-2022-36937 | Exploitation statusNot known exploited | FixYes | Affected productHHVM | Published05/10/2023 | SeverityCritical |
CVE-2023-30792 | Exploitation statusNot known exploited | FixYes | Affected productLexical | Published04/29/2023 | SeverityMedium |
CVE-2022-4899 | Exploitation statusNot known exploited | FixNot confirmed | Affected productzstd | Published03/31/2023 | SeverityHigh |
CVE-2022-36938 | Exploitation statusNot known exploited | FixYes | Affected productRedex | Published11/10/2022 | SeverityCritical |
CVE-2022-40138 | Exploitation statusNot confirmed | FixYes | Affected productHermes | Published10/11/2022 | SeverityUnknown |
CVE-2022-35289 | Exploitation statusNot confirmed | FixYes | Affected productHermes | Published10/11/2022 | SeverityUnknown |
CVE-2022-32234 | Exploitation statusNot confirmed | FixYes | Affected productHermes | Published10/11/2022 | SeverityUnknown |
CVE-2022-27810 | Exploitation statusNot confirmed | FixYes | Affected productHermes | Published10/06/2022 | SeverityUnknown |
CVE-2020-20094 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/23/2022 | SeverityUnknown |
CVE-2020-20093 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/23/2022 | SeverityUnknown |
CVE-2021-24044 | Exploitation statusNot confirmed | FixYes | Affected productHermes | Published01/15/2022 | SeverityUnknown |
CVE-2021-24042 | Exploitation statusNot known exploited | FixYes | Affected productWhatsApp Desktop | Published01/04/2022 | SeverityCritical |
CVE-2021-24045 | Exploitation statusNot confirmed | FixYes | Affected productHermes | Published12/13/2021 | SeverityUnknown |
CVE-2021-24041 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp Business for Android | Published12/07/2021 | SeverityUnknown |
CVE-2019-3556 | Exploitation statusNot confirmed | FixYes | Affected productHHVM | Published10/26/2021 | SeverityUnknown |
CVE-2021-39207Deserialization of Untrusted Data in parlai | Exploitation statusNot confirmed | FixYes | Affected productParlAI | Published09/10/2021 | SeverityHigh |
CVE-2021-24040 | Exploitation statusNot confirmed | FixYes | Affected productParlAI | Published09/10/2021 | SeverityUnknown |
CVE-2021-24038 | Exploitation statusNot confirmed | FixYes | Affected productOculus Desktop | Published08/18/2021 | SeverityUnknown |
CVE-2021-24036 | Exploitation statusNot confirmed | FixYes | Affected productfolly | Published07/23/2021 | SeverityUnknown |
CVE-2021-24037 | Exploitation statusNot confirmed | FixNot confirmed | Affected productHermes | Published06/15/2021 | SeverityUnknown |
CVE-2021-24035 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp Business for Android | Published06/11/2021 | SeverityUnknown |
CVE-2020-1920 | Exploitation statusNot confirmed | FixYes | Affected productreact-native | Published06/01/2021 | SeverityUnknown |
CVE-2021-24028 | Exploitation statusNot confirmed | FixYes | Affected productFacebook Thrift | Published04/13/2021 | SeverityUnknown |
CVE-2021-24218Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion | Exploitation statusNot confirmed | FixYes | Affected productFacebook for WordPress | Published04/12/2021 | SeverityUnknown |
CVE-2021-24217Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain | Exploitation statusNot confirmed | FixYes | Affected productFacebook for WordPress | Published04/12/2021 | SeverityUnknown |
CVE-2021-24026 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp Business for iOS | Published04/06/2021 | SeverityUnknown |
CVE-2021-24027 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp Business for Android | Published04/06/2021 | SeverityUnknown |
CVE-2021-24029 | Exploitation statusNot confirmed | FixYes | Affected productmvfst | Published03/15/2021 | SeverityUnknown |
CVE-2020-1900 | Exploitation statusNot confirmed | FixYes | Affected productHHVM | Published03/11/2021 | SeverityUnknown |
CVE-2020-1899 | Exploitation statusNot confirmed | FixYes | Affected productHHVM | Published03/11/2021 | SeverityUnknown |
CVE-2020-1898 | Exploitation statusNot confirmed | FixYes | Affected productHHVM | Published03/11/2021 | SeverityUnknown |
CVE-2021-24030 | Exploitation statusNot confirmed | FixYes | Affected productFacebook Gameroom | Published03/10/2021 | SeverityUnknown |
CVE-2020-1921 | Exploitation statusNot confirmed | FixYes | Affected productHHVM | Published03/10/2021 | SeverityUnknown |
CVE-2021-24025 | Exploitation statusNot confirmed | FixYes | Affected productHHVM | Published03/10/2021 | SeverityUnknown |
CVE-2020-1919 | Exploitation statusNot confirmed | FixYes | Affected productHHVM | Published03/10/2021 | SeverityUnknown |
CVE-2020-1918 | Exploitation statusNot confirmed | FixYes | Affected productHHVM | Published03/10/2021 | SeverityUnknown |
CVE-2020-1917 | Exploitation statusNot confirmed | FixYes | Affected productHHVM | Published03/10/2021 | SeverityUnknown |
CVE-2020-1916 | Exploitation statusNot confirmed | FixYes | Affected productHHVM | Published03/10/2021 | SeverityUnknown |
CVE-2021-24033 | Exploitation statusNot confirmed | FixYes | Affected productreact-dev-utils | Published03/09/2021 | SeverityUnknown |
CVE-2021-24031 | Exploitation statusNot confirmed | FixYes | Affected productZstandard | Published03/04/2021 | SeverityUnknown |
CVE-2021-24032 | Exploitation statusNot confirmed | FixNot confirmed | Affected productZstandard | Published03/04/2021 | SeverityUnknown |
CVE-2020-1896 | Exploitation statusNot confirmed | FixNot confirmed | Affected productHermes | Published02/02/2021 | SeverityUnknown |
CVE-2020-1909 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp Business for iOS | Published11/03/2020 | SeverityUnknown |
CVE-2020-1908 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp Business for iOS | Published11/03/2020 | SeverityUnknown |
CVE-2020-1915 | Exploitation statusNot confirmed | FixNot confirmed | Affected productHermes | Published10/26/2020 | SeverityUnknown |
CVE-2020-1914 | Exploitation statusNot confirmed | FixNot confirmed | Affected productHermes | Published10/08/2020 | SeverityUnknown |
CVE-2020-1907 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp for Android | Published10/06/2020 | SeverityUnknown |
CVE-2020-1904 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp for iOS | Published10/06/2020 | SeverityUnknown |
CVE-2020-1906 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp for Android | Published10/06/2020 | SeverityUnknown |
CVE-2020-1905 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp for Android | Published10/06/2020 | SeverityUnknown |
CVE-2020-1902 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp for Android | Published10/06/2020 | SeverityUnknown |
CVE-2020-1903 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp for iOS | Published10/06/2020 | SeverityUnknown |
CVE-2020-1901 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp for iOS | Published10/06/2020 | SeverityUnknown |
CVE-2020-1913 | Exploitation statusNot confirmed | FixNot confirmed | Affected productHermes | Published09/09/2020 | SeverityUnknown |
CVE-2020-1912 | Exploitation statusNot confirmed | FixNot confirmed | Affected productHermes | Published09/09/2020 | SeverityUnknown |
CVE-2020-1911 | Exploitation statusNot confirmed | FixNot confirmed | Affected productHermes | Published09/04/2020 | SeverityUnknown |
CVE-2020-1891 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp Android | Published09/03/2020 | SeverityUnknown |
CVE-2020-1894 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp Android | Published09/03/2020 | SeverityUnknown |
CVE-2020-1889 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp Desktop | Published09/03/2020 | SeverityUnknown |
CVE-2020-1890 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp for Android | Published09/03/2020 | SeverityUnknown |
CVE-2020-1886 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp for Android | Published09/03/2020 | SeverityUnknown |
CVE-2019-11928 | Exploitation statusNot confirmed | FixYes | Affected productWhatsApp Desktop | Published09/03/2020 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan