Exposición de WordPress

Blogs, CMS
2604
score de exposición
2.809.159
sitios usan
2
en explotación
193
críticos
Análisis Vexday

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2562 resultados
CVE-2015-10139HIGHWPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege EscalationEPSS 1.6%CVE-2021-24910—Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site ScriptingEPSS 1.6%CVE-2021-24537—Similar Posts <= 3.1.5 - Admin+ Arbitrary PHP Code ExecutionEPSS 1.6%CVE-2023-4142HIGHWP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code ExecutionEPSS 1.6%CVE-2023-4141HIGHWP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code ExecutionEPSS 1.6%CVE-2021-24392—WordPress Membership SwiftCloud.io <= 1.0 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24390—Alipay <= 3.7.2 - Authenticated SQL InjectionEPSS 1.5%CVE-2020-36724CRITICALWordable <= 3.1.1 - Authentication BypassEPSS 1.5%CVE-2024-2411CRITICALMasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modalEPSS 1.5%CVE-2020-11025MEDIUMAuthenticated cross-site scripting (XSS) in WordPress CustomizerEPSS 1.5%CVE-2022-0230—Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.5%CVE-2021-24403—WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL InjectionEPSS 1.5%CVE-2021-24396—GSEOR <= 1.3 - Authenticated SQL InjectionEPSS 1.5%CVE-2022-0537—MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code ExecutionEPSS 1.5%CVE-2022-27844LOWWordPress WPvivid plugin <= 0.9.70 - Arbitrary File Read vulnerabilityEPSS 1.5%CVE-2021-39201HIGHAuthenticated cross-site scripting (XSS) in WordPress editorEPSS 1.5%CVE-2025-3455HIGH1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.5%CVE-2022-1904—Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-ScriptingEPSS 1.5%CVE-2017-2217—Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary webEPSS 1.5%CVE-2022-1273—Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCEEPSS 1.5%