Exposición de WordPress

Blogs, CMS
2604
score de exposición
2.809.159
sitios usan
2
en explotación
193
críticos
Análisis Vexday

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2562 resultados
CVE-2021-36917MEDIUMWordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerabilityEPSS 2.0%CVE-2020-4048MEDIUMOpen redirect in wp_validate_redirect() in WordPressEPSS 2.0%CVE-2022-3360HIGHLearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST APIEPSS 2.0%CVE-2021-39200MEDIUMInformation Disclosure in wp_die() via JSONP in wordpressEPSS 2.0%CVE-2020-5768—Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WEPSS 2.0%CVE-2026-65640HIGHWordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. PrEPSS 1.9%CVE-2022-0271—LearnPress < 4.1.6 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2022-1756—Newsletter < 7.4.5 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2021-25111—English WordPress Admin < 1.5.2 - Unauthenticated Open RedirectEPSS 1.9%CVE-2021-24221—Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcodeEPSS 1.9%CVE-2021-24228—Patreon WordPress < 1.7.2 - Reflected XSS on Login FormEPSS 1.9%CVE-2026-8832HIGHWPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPostEPSS 1.9%CVE-2021-36916HIGHWordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerabilityEPSS 1.9%CVE-2022-2373—Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address DisclosureEPSS 1.9%CVE-2020-6009—LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.EPSS 1.8%CVE-2022-2376—Directorist < 7.3.1 - Unauthenticated Email Address DisclosureEPSS 1.8%CVE-2019-1010104—TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The componeEPSS 1.8%CVE-2021-26609HIGHWordPress Mangboard SQL-Injection vulnerabilityEPSS 1.8%CVE-2022-34858CRITICALWordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerabilityEPSS 1.8%CVE-2021-24229—Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX actionEPSS 1.8%