Exposure of WordPress

Blogs, CMS
2,604
exposure score
2,809,159
sites use
2
exploited
193
critical
Vexday analysis

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2,562 results
CVE-2021-24178—Business Directory Plugin < 5.11.1 - Arbitrary Add/Edit/Delete Form Field to Stored XSSEPSS 0.7%CVE-2025-1771CRITICALTraveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_postEPSS 0.7%CVE-2026-14282CRITICALGoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload FieldEPSS 0.7%CVE-2022-45077MEDIUMWordPress Betheme theme <= 26.5.1.4 - Auth. PHP Object Injection vulnerabilityEPSS 0.7%CVE-2021-45729MEDIUMWordPress WP Google Map plugin <= 1.8.0 - Privilege Escalation vulnerabilityEPSS 0.7%CVE-2024-13787CRITICALVEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object InjectionEPSS 0.7%CVE-2023-25998HIGHWordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2025-28947HIGHWordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2021-24502—WP Google Map < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2022-1010—Login using WordPress Users < 1.13.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2022-2181—Advanced WordPress Reset < 1.6 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2022-27859MEDIUMWordPress Travel Management plugin <= 2.0 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.7%CVE-2024-1668MEDIUMAvada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form EntriesEPSS 0.7%CVE-2021-4371MEDIUMWP Quick FrontEnd Editor <= 5.5 - Authenticated Settings ChangeEPSS 0.7%CVE-2019-25145HIGHContact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injectionEPSS 0.7%CVE-2022-43492MEDIUMWordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.7%CVE-2025-7846HIGHWordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields FunctionEPSS 0.7%CVE-2021-4348HIGHUltimate GDPR & CCPA <= 2.4 - Unauthenticated Settings Import & ExportEPSS 0.7%CVE-2022-41655MEDIUMWordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerabilityEPSS 0.7%CVE-2023-0911MEDIUMShortcodes Ultimate < 5.12.8 - Subscriber+ User Meta DisclosureEPSS 0.7%