Exposición de WordPress

Blogs, CMS
2604
score de exposición
2.809.159
sitios usan
2
en explotación
193
críticos
Análisis Vexday

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2562 resultados
CVE-2022-38135MEDIUMWordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2025-47670HIGHWordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion VulnerabilityEPSS 0.6%CVE-2021-33852—A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicEPSS 0.6%CVE-2025-8009MEDIUMSecurity Ninja – Secure Firewall & Secure Malware Scanner - 5.201 - 5.242 - Authenticated (Administrator+) Arbitrary File ReadEPSS 0.6%CVE-2022-36347MEDIUMWordPress Alpine PhotoTile for Pinterest plugin <= 1.3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-24620—Simple eCommerce <= 2.2.5 - Arbitrary File UploadEPSS 0.6%CVE-2021-24804—Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRFEPSS 0.6%CVE-2021-24180—Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.6%CVE-2024-31115CRITICALWordPress Chauffeur Taxi Booking System for WordPress plugin <= 7.2 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2026-1992HIGHExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin InstallationEPSS 0.6%CVE-2022-29417MEDIUMWordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerabilityEPSS 0.6%CVE-2022-23981MEDIUMWordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Set Featured Brand vulnerabilityEPSS 0.6%CVE-2023-51419CRITICALWordPress BERTHA AI Plugin <= 1.11.10.7 is vulnerable to Arbitrary File UploadEPSS 0.6%CVE-2021-36841MEDIUMYITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability.EPSS 0.6%CVE-2024-8855CRITICALWordPress Auction <= 3.7 - Editor+ SQL InjectionEPSS 0.6%CVE-2022-45810MEDIUMWordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV InjectionEPSS 0.6%CVE-2021-24424—WP Reset < 1.90 - Authenticated Stored XSSEPSS 0.6%CVE-2024-0594HIGHAwesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL InjectionEPSS 0.6%CVE-2022-2190MEDIUMEnvira Gallery Lite < 1.8.4.7 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2025-4187MEDIUMUserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File ReadEPSS 0.6%