Vulnerabilidades em automattic
76 resultadosAnálise Vexday
A Automattic tem 8 vulnerabilidades registradas na base do Vexday, sendo 1 crítica, todas sem exploração ativa conhecida (KEV). A fraqueza predominante é Cross-Site Scripting (CWE-79), indicando problemas de validação de entrada em aplicações web. Sem publicações de vulnerabilidades nos últimos 90 dias, o risco atual é estável e de baixa urgência operacional.
CVE-2026-125119HIGHMongoose: Connection-level sanitizeFilter not appliedEPSS 0.5%CVE-2026-73562MEDIUMMongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)EPSS 0.5%CVE-2024-32111MEDIUMWordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerabilityEPSS 0.5%CVE-2024-37423HIGHWordPress Newspack Blocks plugin <= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerabilityEPSS 0.5%CVE-2023-51503MEDIUMWordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR)EPSS 0.5%CVE-2026-48888HIGHWordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerabilityEPSS 0.5%CVE-2024-43968MEDIUMWordPress Newspack plugin < 3.8.7 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-5062MEDIUMWooCommerce <= 9.4.2 - PostMessage-Based Cross-Site ScriptingEPSS 0.5%CVE-2023-47788MEDIUMWordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-37475MEDIUMWordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-37425MEDIUMWordPress Newspack Blocks plugin <= 3.0.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-37477MEDIUMWordPress Newspack Content Converter plugin <= 0.1.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-66666MEDIUMWordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerabilityEPSS 0.4%CVE-2026-125118MEDIUMMongoose: Prototype pollution via Schema.prototype.virtual()EPSS 0.4%CVE-2026-57777HIGHWordPress WooCommerce plugin < 11.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-39666MEDIUMWordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-49828MEDIUMWordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-52211MEDIUMWordPress WP Job Manager plugin <= 2.0.0 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-4392MEDIUMJetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo ShortcodeEPSS 0.4%CVE-2025-69015LOWWordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerabilityEPSS 0.4%