Exposición de WordPress

Blogs, CMS
2419
score de exposición
2.853.655
sitios usan
2
en explotación
186
críticos
Análisis Vexday

WordPress acumula 2.381 CVEs catalogadas, com 174 classificadas como críticas e 95 surgidas apenas nos últimos 90 dias, o que indica um fluxo contínuo e elevado de novas vulnerabilidades para a plataforma. A falha mais comum é CWE-79 (Cross-Site Scripting), refletindo a superfície de ataque característica de ambientes com grande volume de plugins e temas de terceiros. Embora a taxa de exploração ativa esteja abaixo da média geral do catálogo CISA KEV, o EPSS máximo observado chega a 0,977, e o CVE-2022-21661 — uma vulnerabilidade de consulta SQL — apresenta EPSS de 0,978, sinalizando altíssima probabilidade de exploração e merecendo atenção prioritária em qualquer plano de remediação. Equipes de segurança devem monitorar ativamente o ritmo de publicações recentes e manter políticas rigorosas de atualização, especialmente em instalações com extensões de terceiros.

CVEs

2469 resultados
CVE-2020-11027MEDIUMPassword reset links invalidation issue in WordPressEPSS 13.6%CVE-2022-2551—Duplicator < 1.4.7 - Unauthenticated Backup DownloadEPSS 13.2%CVE-2021-24915—Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address DisclosureEPSS 12.7%CVE-2013-1916—In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on thEPSS 12.4%CVE-2024-9593HIGHTime Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code ExecutionEPSS 12.3%CVE-2024-8529CRITICALLearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'EPSS 11.8%CVE-2023-23489CRITICALThe Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in thEPSS 11.2%CVE-2024-4443CRITICALBusiness Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields ParameterEPSS 10.4%CVE-2024-4295CRITICALEmail Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hashEPSS 10.2%CVE-2025-34077CRITICALWordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCEEPSS 9.9%CVE-2021-43408MEDIUMDuplicate Post WordPress Plugin SQL Injection VulnerabilityEPSS 9.5%CVE-2025-4524CRITICALMadara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File InclusionEPSS 9.5%CVE-2022-0814—Ubigeo de Peru < 3.6.4 - Unauthenticated SQLiEPSS 9.4%CVE-2023-6634HIGHLearnPress <= 4.2.5.7 - Command InjectionEPSS 8.5%CVE-2024-9935HIGHPDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File DownloadEPSS 7.4%CVE-2022-0864—UpdraftPlus < 1.22.9 - Reflected Cross-Site ScriptingEPSS 7.4%CVE-2017-6104—Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.EPSS 7.3%CVE-2020-5766—Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 aEPSS 7.2%CVE-2023-2437CRITICALUserPro <= 5.1.1 - Authentication Bypass to AdministratorEPSS 6.8%CVE-2021-36888CRITICALWordPress Image Hover Effects Ultimate plugin <= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromiseEPSS 6.7%