Exposición de WordPress

Blogs, CMS
2604
score de exposición
2.809.159
sitios usan
2
en explotación
193
críticos
Análisis Vexday

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2562 resultados
CVE-2021-25037—All In One SEO < 4.1.5.3 - Authenticated SQL InjectionEPSS 1.3%CVE-2022-34149CRITICALWordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerabilityEPSS 1.3%CVE-2022-1800—Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL InjectionEPSS 1.3%CVE-2021-24877—MainWP Child < 4.1.8 - Admin+ SQL InjectionEPSS 1.3%CVE-2012-10025CRITICALWordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File InclusionEPSS 1.3%CVE-2023-6826HIGHE2Pdf <= 1.20.25 - Authenticated (Administrator+) Arbitrary File UploadEPSS 1.3%CVE-2022-34154HIGHWordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerabilityEPSS 1.3%CVE-2022-36375HIGHWordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerabilityEPSS 1.3%CVE-2022-33969HIGHWordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerabilityEPSS 1.3%CVE-2022-0535—E2Pdf < 1.16.45 - Admin+ Stored Cross-Site Scripting (XSS)EPSS 1.3%CVE-2016-15041HIGHMainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site ScriptingEPSS 1.3%CVE-2024-6846MEDIUMSmartSearchWP <= 2.4.4 - Unauthenticated Log PurgeEPSS 1.3%CVE-2021-4346CRITICALuListing <= 1.6.6 - Unauthenticated Arbitrary Account ChangesEPSS 1.2%CVE-2023-7082HIGHWP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCEEPSS 1.2%CVE-2026-39468MEDIUMWordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerabilityEPSS 1.2%CVE-2025-2008HIGHImport Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.2%CVE-2024-0699MEDIUMAI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_urlEPSS 1.2%CVE-2022-43497MEDIUMCross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scriEPSS 1.2%CVE-2022-23982MEDIUMWordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Server Information Exposure vulnerabilityEPSS 1.2%CVE-2022-2559—Fluent Support < 1.5.8 - Admin+ SQLiEPSS 1.2%