Exposure of WordPress

Blogs, CMS
2,604
exposure score
2,809,159
sites use
2
exploited
193
critical
Vexday analysis

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2,562 results
CVE-2021-36848LOWWordPress Social Media Feather plugin <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-36910LOWWordPress WP-Appbox plugin <= 4.3.20 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-11371MEDIUMTheater for WordPress <= 0.18.6.2 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2021-25105—Ivory Search < 5.4.1 - Multiple Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-23987—WS Form < 1.8.176 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24230—Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User MetaEPSS 0.6%CVE-2022-1027—Page Restriction WordPress < 1.2.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24714—WP All Import < 3.6.3 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24718—ARForms Form Builder < 1.5 - Admin+ Stored Cross Site ScriptingEPSS 0.6%CVE-2022-29923MEDIUMWordPress Quick Restaurant Reservations plugin <= 1.4.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-36847MEDIUMWordPress Webba Booking plugin <= 4.2.21 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-36829MEDIUMWordPress Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2022-2398—WP Comments Fields < 4.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-2395—weForms < 1.6.14 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-2305—WordPress Popup <= 1.9.3.8 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2026-12127MEDIUMWPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display NameEPSS 0.6%CVE-2023-3708MEDIUMMultiple DeoThemes Themes <= (Various Versions) - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2023-41798MEDIUMWordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV InjectionEPSS 0.6%CVE-2021-36857MEDIUMWordPress Testimonial Builder plugin <= 1.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2026-7459HIGHSimple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction EndpointEPSS 0.6%