Exposición de WordPress

Blogs, CMS
2604
score de exposición
2.809.159
sitios usan
2
en explotación
193
críticos
Análisis Vexday

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2562 resultados
CVE-2022-45370MEDIUMWordPress WordPress Comments Import & Export Plugin <= 2.3.1 is vulnerable to CSV InjectionEPSS 0.8%CVE-2022-27845MEDIUMWordPress Plausible Analytics plugin <= 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2023-2446MEDIUMUserPro <= 5.1.1 - Sensitive Information Disclosure via ShortcodeEPSS 0.8%CVE-2023-5692MEDIUMWordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalinkEPSS 0.8%CVE-2025-4200HIGHZagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File InclusionEPSS 0.8%CVE-2022-29419MEDIUMWordPress 3xSocializer plugin <= 0.98.22 - Authenticated SQL Injection (SQLi) vulnerabilityEPSS 0.8%CVE-2024-2409CRITICALMasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX ActionEPSS 0.8%CVE-2021-26256MEDIUMWordPress Survey Maker plugin <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2024-13091CRITICALWPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File UploadEPSS 0.8%CVE-2024-2344HIGHAvada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entryEPSS 0.8%CVE-2022-25607MEDIUMWordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerabilityEPSS 0.8%CVE-2021-24373—WP Hardening < 1.2.2 - Reflected XSS via historyvalueEPSS 0.8%CVE-2021-24372—WP Hardening < 1.2.2 - Reflected XSS via URIEPSS 0.8%CVE-2021-24368—Quiz And Survey Master < 7.1.18 - Reflected Cross-Site Scripting (XSS)EPSS 0.8%CVE-2021-24290—Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 0.8%CVE-2025-6991HIGHKallyas <= 4.21.0 - Authenticated (Contributor+) Local File InclusionEPSS 0.8%CVE-2021-24783—Post Expirator < 2.6.0 - Contributor+ Arbitrary Post Schedule DeletionEPSS 0.8%CVE-2023-40606CRITICALWordPress Kanban Boards for WordPress Plugin <= 2.5.21 is vulnerable to Arbitrary Code ExecutionEPSS 0.8%CVE-2025-2158HIGHWordPress Review Plugin: The Ultimate Solution for Building a Review Website <= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom FieldsEPSS 0.8%CVE-2021-39202HIGHWordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widgetEPSS 0.8%