¿Es seguro Wordfence Security?

Qué hace este plugin

• Slug: wordfence
• 5000000+ instalaciones activas

2FAfirewallmalwarescannersecurity

Estado de mantenimiento

• Última versión conocida: 8.2.2
• Requiere PHP: 7.0+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

4 CVEs conocidos registrados para Wordfence Security. Reportadas entre 2012 y 2022.

CVE-2022-3144

The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2019-9669

The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of rules hosted on vendor servers and pushed to the plugin with no versioning associated. Bypassing a WAF rule doesn't make a WordPress site vulnerable (speaking in terms of software vulnerabilities)

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 7.1.14

Wordfence before 7.1.14 was vulnerable in certain unusual configurations to Reflected Cross-Site Scripting, as well as full path disclosure and author name disclosure.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 6.1.7

The Wordfence plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘adminURL’ parameter in versions 6.1.1 through 6.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4

This plugin is prone to banned IP functionality bypass vulnerability. Unlogged requests won't trigger automatic throttling and banning. Update plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.7

This plugin is prone to lib/IPTraf.php User-Agent header stored cross site scripting vulnerability. Update plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4

This plugin is prone to stored XSS, insufficient logging, throttle bypass and exploit detection bypass vulnerabilities. Update plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3

This plugin is prone to a password creation restriction bypass vulnerability. Update plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 26 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5	—	Desconocido	< 5.2.5	5.2.5	2015-05-15	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.3	—	Desconocido	< 5.2.3	5.2.3	2015-05-15	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3	—	Desconocido	< 3.8.3	3.8.3	2015-05-15	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7	—	Desconocido	< 3.3.7	3.3.7	2015-05-15	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5	—	Desconocido	< 5.2.5	5.2.5	2015-05-15	✓ corregido en la última versión
CVE-2014-4932	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.1.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 5.1.5	5.1.5	2014-12-08	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4	—	Desconocido	< 5.2.4	5.2.4	2014-09-27	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] <= 5.2.3	—	Desconocido	< 5.2.3	5.2.3	2014-09-14	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4	—	Desconocido	< 5.2.4	5.2.4	2014-09-14	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4	—	Desconocido	< 5.2.4	5.2.4	2014-09-14	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.3	—	Desconocido	< 5.2.3	5.2.3	2014-09-08	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3	—	Desconocido	< 3.8.3	3.8.3	2014-08-01	✓ corregido en la última versión
CVE-2014-4664	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Desconocido	< 5.2.5	5.2.5	2014-06-26	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7	—	Desconocido	< 3.3.7	3.3.7	2012-10-19	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7	—	Desconocido	< 3.3.7	3.3.7	2012-10-19	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.6	—	Desconocido	< 3.3.6	3.3.6	2012-10-18	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 7.1.14	—	Desconocido	< 7.1.14	7.1.14	—	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.3	—	Desconocido	< 5.2.3	5.2.3	—	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4	—	Desconocido	< 5.2.4	5.2.4	—	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4	—	Desconocido	< 5.2.4	5.2.4	—	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5	—	Desconocido	< 5.2.5	5.2.5	—	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5	—	Desconocido	< 5.2.5	5.2.5	—	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7	—	Desconocido	< 3.3.7	3.3.7	—	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3	—	Desconocido	< 3.8.3	3.8.3	—	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3	—	Desconocido	< 3.8.3	3.8.3	—	✓ corregido en la última versión
—	Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.7	—	Desconocido	< 3.8.7	3.8.7	—	✓ corregido en la última versión

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5

This plugin is prone to IPTraf.php URI request stored cross site scripting vulnerability. Update plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.3

This plugin is prone to cross site scripting in referer header. Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3

This plugin is prone to wp-admin/admin.php whois parameter stored cross site scripting vulnerability. Update plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7

This plugin is prone to "email" cross site scripting and insufficient anti-automation vulnerabilities. Update plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5

This plugin is prone to an unspecified issue. Update plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2014-4932

Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4

The Wordfence Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '$_SERVER['HTTP_HOST']' in PHP in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthorized attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] <= 5.2.3

WordPress Wordfence Security plugin is prone to multiple HTML injection and security bypass vulnerabilities. These issues allow HTML and script code run in the context of the affected browser. In this way an attacker can steal cookie-based authentication credentials or control how the site is rendered to the user. Upgrade the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4

The Wordfence Plugin is vulnerable to multiple protection mechanism bypasses in version up to, and including, 5.2.3. These allow unauthenticated attackers to bypass exploit protection and throttling restrictions.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4

The Wordfence plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '$_SERVER['REQUEST_URI']' parameters in versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.3

The Wordfence plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Referer Header in versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3

The Wordfence Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wfwhois’ parameter in versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2014-4664

Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7

The Wordfence plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘email’ parameter in versions before 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7

WordPress plugin Wordfence versions 3.3.6 and older were vulnerable to Cross-Site Scripting via the unlockEmail functionality.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.6

WordPress Wordfence Security plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication credentials. Other attacks are also possible. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 7.1.14

The plugin protection against user enumeration (ie ?author=id) could be bypassed by using an array as author parameter

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.3

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a XSS in Referer Header security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.4

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a Banned IP Functionality Bypass security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by an IPTraf.php URI Request Stored XSS security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 5.2.5

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by an Unspecified Issue security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.3.7

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a XSS & IAA security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a wp-admin/admin.php whois Parameter Stored XSS security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.3

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a Password Creation Restriction Bypass security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Wordfence Security – Firewall, Malware Scan, and Login Security [wordfence] < 3.8.7

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a lib/IPTraf.php User-Agent Header Stored XSS security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Wordfence Security actualizado — 8.2.2 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) — 3000000+ instalaciones activas — 98/100 (8847) — PHP máx. 8.4
• Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention — 1000000+ instalaciones activas — 98/100 (1467) — PHP máx. 8.4
• Security Optimizer – The All-In-One Protection Plugin — 1000000+ instalaciones activas — 90/100 (155) — PHP máx. <8.0
• All-In-One Security (AIOS) – Security and Firewall — 1000000+ instalaciones activas — 94/100 (1708)
• Sucuri Security – Auditing, Malware Scanner and Security Hardening — 600000+ instalaciones activas — 84/100 (384)