Exposição de WordPress

Blogs, CMS
2.604
score de exposição
2.809.159
sites usam
2
em exploração
193
críticos
Análise Vexday

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2.562 resultados
CVE-2022-36793MEDIUMWordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilitiesEPSS 0.9%CVE-2021-38340MEDIUMWordpress Simple Shop <= 1.2 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2023-2449CRITICALUserPro <= 5.1.1 - Insecure Password Reset MechanismEPSS 0.9%CVE-2024-0825HIGHVimeography: Vimeo Video Gallery WordPress Plugin <= 2.3.2 - Authenticated (Contributor+) PHP Object InjectionEPSS 0.9%CVE-2025-13956MEDIUMLearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics ExposureEPSS 0.9%CVE-2022-44584CRITICALWordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Deletion vulnerabilityEPSS 0.9%CVE-2022-4320MEDIUMWordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSSEPSS 0.9%CVE-2021-24164—Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key DisclosureEPSS 0.9%CVE-2021-36898HIGHWordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. SQL Injection (SQLi) vulnerabilityEPSS 0.9%CVE-2023-28665MEDIUMThe Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page'EPSS 0.9%CVE-2022-29410HIGHWordPress Hermit 音乐播放器 plugin <= 3.1.6 - Authenticated SQL Injection (SQLi) vulnerabilityEPSS 0.9%CVE-2022-36427HIGHWordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerabilityEPSS 0.9%CVE-2022-43468HIGHExternal initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore theEPSS 0.9%CVE-2022-42459HIGHWordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerabilityEPSS 0.9%CVE-2023-2500HIGHGo Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Subscriber+) PHP Object InjectionEPSS 0.9%CVE-2025-2101HIGHEdumall <= 4.2.4 - Unauthenticated Local File InclusionEPSS 0.9%CVE-2025-31015HIGHWordPress SMTP Service, Email Delivery Solved! — MailHawk plugin <= 1.3.1 - Local File Inclusion VulnerabilityEPSS 0.9%CVE-2024-8704HIGHAdvanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_localeEPSS 0.9%CVE-2022-27858HIGHWordPress Activity Log plugin <= 2.8.3 - CSV Injection vulnerabilityEPSS 0.9%CVE-2022-0161—ARI Fancy Lightbox < 1.3.9 - Reflected Cross-Site ScriptingEPSS 0.9%