Vulnerabilities in wpdive
11 resultsVexday analysis
O WPDive apresenta 11 vulnerabilidades na base, com apenas 1 crítica e nenhuma sob ataque ativo conhecido, reduzindo o risco imediato. A fraqueza dominante é Cross-Site Scripting (CWE-79), típica de plugins WordPress, com atividade recente limitada a 1 publicação nos últimos 90 dias. O panorama sugere risco moderado, sem pressão de exploração em massa, mas exigindo atenção ao XSS em ambientes web.
CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2024-2280MEDIUMBetter Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget linksEPSS 0.4%CVE-2026-25429CRITICALWordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2026-6394MEDIUMNexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' ParameterEPSS 0.3%CVE-2026-2503MEDIUMElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' ParameterEPSS 0.2%CVE-2025-12830MEDIUMBetter Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider WidgetEPSS 0.2%CVE-2025-8624MEDIUMNexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps WidgetEPSS 0.2%CVE-2025-30952MEDIUMWordPress Nexa Blocks plugin <= 1.1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-24556MEDIUMWordPress ElementCamp plugin <= 2.3.2 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-30976MEDIUMWordPress Nexa Blocks plugin <= 1.1.1 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2023-41656MEDIUMWordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerabilityEPSS 0.2%