Exposição de WordPress

Blogs, CMS
2.604
score de exposição
2.809.159
sites usam
2
em exploração
193
críticos
Análise Vexday

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2.562 resultados
CVE-2023-49750CRITICALWordPress Couponis Demo Plugin < 2.2 is vulnerable to SQL InjectionEPSS 0.8%CVE-2026-6070CRITICALWP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' ParameterEPSS 0.8%CVE-2024-13889HIGHWordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object InjectionEPSS 0.8%CVE-2023-25999HIGHWordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Local File Inclusion VulnerabilityEPSS 0.8%CVE-2025-28945HIGHWordPress Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Local File Inclusion VulnerabilityEPSS 0.8%CVE-2021-24504—WP LMS <= 1.1.2 - Stored Cross-Site Scripting (XSS)EPSS 0.8%CVE-2024-12811HIGHTraveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via ShortcodeEPSS 0.8%CVE-2023-25455MEDIUMWordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content Deletion vulnerabilityEPSS 0.8%CVE-2022-45069MEDIUMWordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerabilityEPSS 0.8%CVE-2021-36885MEDIUMWordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2022-29415MEDIUMWordPress Ravpage plugin <= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2022-40687MEDIUMWordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.8%CVE-2021-36895MEDIUMWordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image uploadEPSS 0.8%CVE-2024-1505HIGHAcademy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.8%CVE-2023-5949—SmartCrawl WordPress SEO checker < 3.8.3 - Unauthenticated Password Protected Post DisclosureEPSS 0.8%CVE-2021-36869MEDIUMWordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2025-10690CRITICALGoza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin InstallationEPSS 0.8%CVE-2025-3671HIGHWPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password UpdateEPSS 0.8%CVE-2025-5014HIGHHome Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 0.8%CVE-2024-11816HIGHThe Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code ExecutionEPSS 0.8%