Exposição de WordPress

Blogs, CMS
2.604
score de exposição
2.809.159
sites usam
2
em exploração
193
críticos
Análise Vexday

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2.562 resultados
CVE-2024-31103HIGHWordPress Kanban Boards for WordPress plugin <= 2.5.21 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-32172MEDIUMWordPress YaMaps for WordPress plugin <= 0.6.40 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-31735MEDIUMWordPress Footnotes for WordPress plugin <= 2016.1230 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-24666MEDIUMWordPress Hyve Lite plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-3899MEDIUMEnvira Gallery < 1.8.15 - Author+ Stored XSSEPSS 0.4%CVE-2026-1832MEDIUMThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache DeletionEPSS 0.4%CVE-2026-7249MEDIUMLocation Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache PurgingEPSS 0.4%CVE-2026-23806HIGHWordPress Jobs for WordPress plugin <= 2.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-10260HIGHTripetto <= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File UploadEPSS 0.4%CVE-2023-5357MEDIUMInstagram for WordPress <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-8781MEDIUMBookster – WordPress Appointment Booking Plugin <= 2.1.1 - Authenticated (Administrator+) SQL Injection via 'raw'EPSS 0.4%CVE-2023-1840MEDIUMSp*tify Play Button for WordPress <= 2.07 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-0779HIGHEnjoy Social Feed <= 6.2.2 - Unauthenticated Arbitrary Instagram Account UnlinkingEPSS 0.4%CVE-2025-49328HIGHWordPress Store Locator WordPress plugin <= 1.5.1 - SQL Injection VulnerabilityEPSS 0.4%CVE-2023-51501HIGHWordPress Uncode Core Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-50893HIGHWordPress UpSolution Core Plugin <= 8.17.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-29932MEDIUMWordPress WordPress Meta Data and Taxonomies Filter (MDTF) plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-4305MEDIUMRoyal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' ParameterEPSS 0.4%CVE-2024-4621MEDIUMArForms < 6.6 - Admin+ Stored XSSEPSS 0.4%CVE-2024-8434MEDIUMEasy Mega Menu Plugin for WordPress – ThemeHunk <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings UpdatesEPSS 0.4%