Vulnerabilities in WordPress
37 resultsVexday analysis
WordPress apresenta 33 vulnerabilidades catalogadas, das quais 2 foram publicadas recentemente (últimos 90 dias), sem evidências atuais de exploração em massa. A fraqueza dominante é Cross-Site Scripting (CWE-79), com apenas 2 falhas críticas, indicando um perfil de risco moderado onde a maioria das exposições permanece de baixa a média severidade.
CVE-2021-39200MEDIUMInformation Disclosure in wp_die() via JSONP in wordpressEPSS 2.0%CVE-2019-16780MEDIUMStored cross-site scripting (XSS) in WordPress block editorEPSS 1.7%CVE-2020-11025MEDIUMAuthenticated cross-site scripting (XSS) in WordPress CustomizerEPSS 1.5%CVE-2021-39201HIGHAuthenticated cross-site scripting (XSS) in WordPress editorEPSS 1.5%CVE-2020-11030MEDIUMCross-site scripting (XSS) in Search block in WordPressEPSS 1.4%CVE-2020-4050LOWset-screen-option filter misuse by plugins leading to privilege escalation in WordPressEPSS 1.4%CVE-2019-16781MEDIUMStored cross-site scripting (XSS) in WordPress block editorEPSS 1.4%CVE-2024-31210HIGHPHP file upload bypass via Plugin installerEPSS 0.9%CVE-2021-39203MEDIUMPrivate data disclosure/privilege escalation through the block editor in WordpressEPSS 0.9%CVE-2026-64638HIGHWordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malicious third-party websEPSS 0.9%CVE-2021-39202HIGHWordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widgetEPSS 0.8%CVE-2025-54352LOWWordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: theEPSS 0.3%CVE-2023-54333HIGHSocial-Share-Buttons 2.2.3 - SQL Injection via project_id ParameterEPSS 0.3%CVE-2025-58246MEDIUMWordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure VulnerabilityEPSS 0.2%CVE-2020-37233MEDIUMWordPress Plugin Buddypress 6.2.0 Persistent Cross-Site ScriptingEPSS 0.2%CVE-2025-58674MEDIUMWordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-45293HIGHWordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerabilityEPSS 0.2%