Exposição de WordPress

Blogs, CMS
2.604
score de exposição
2.809.159
sites usam
2
em exploração
193
críticos
Análise Vexday

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2.562 resultados
CVE-2025-32597HIGHWordPress WordPress Events Calendar Plugin – connectDaily plugin <= 1.5.4 - CSRF to Cross-Site Scripting vulnerabilityEPSS 0.2%CVE-2025-6692MEDIUMYouTube Embed <= 10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via instance ParameterEPSS 0.2%CVE-2025-11770MEDIUMBrightTALK WordPress Shortcode <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-13697MEDIUMBlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via `timestamp` AttributeEPSS 0.2%CVE-2024-8319MEDIUMTourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple FunctionsEPSS 0.2%CVE-2026-22342HIGHWordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerabilityEPSS 0.2%CVE-2024-31285HIGHWordPress WordPress Tooltips plugin <= 9.5.3 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-12168MEDIUMPhrase TMS Integration for WordPress <= 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Log DeletionEPSS 0.2%CVE-2026-3140MEDIUMUltimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/DeactivationEPSS 0.2%CVE-2026-8943MEDIUMGoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() FunctionEPSS 0.2%CVE-2024-37941MEDIUMWordPress Internal Link Juicer: SEO Auto Linker for WordPress plugin <= 2.24.3 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2024-43269MEDIUMWordPress Backup and Restore WordPress plugin <= 1.50 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2025-12124MEDIUMFitVids for WordPress <= 4.0.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-12324MEDIUMTablePress – Tables in WordPress made easy <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-12651MEDIUMLive Photos on WordPress <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2025-6988MEDIUMKallyas <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-13728MEDIUMFluentAuth - Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' ShortcodeEPSS 0.2%CVE-2025-10295MEDIUMAngel – Fashion Model Agency WordPress CMS Theme <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2023-2447MEDIUMUserPro <= 5.1.1 - Cross-Site Request Forgery to Sensitive Information ExposureEPSS 0.2%CVE-2026-7561MEDIUMTm – WordPress Redirection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%