Plugin vulnerável: cleantalk-spam-protect 6.86 (CVE-2026-77830, CVE-2026-19855) em fiscontau.com.br
Plugin vulnerável: revslider 6.5.9 (CVE-2024-34444, CVE-2024-8107, CVE-2026-9050, CVE-2026-6728, CVE-2025-10249, CVE-2024-4637, CVE-2023-2359, CVE-2024-34443, CVE-2023-47772, CVE-2024-4092, CVE-2024-37449, CVE-2023-6528, CVE-2024-4581, CVE-2023-47784, CVE-2025-9217, CVE-2024-2306) em fiscontau.com.br
Plugin vulnerável: js_composer 6.7.0 (CVE-2025-4968, CVE-2024-5708, CVE-2025-11161, CVE-2024-1841, CVE-2024-5265, CVE-2025-11160, CVE-2025-10006, CVE-2024-1842, CVE-2023-31213, CVE-2024-1805, CVE-2024-5709, CVE-2025-4965, CVE-2026-15101, CVE-2026-45436, CVE-2024-1840, CVE-2025-7502) em fiscontau.com.br
Plugin vulnerável: wpvivid-backuprestore 0.9.132 (CVE-2026-82194, CVE-2026-82193, CVE-2026-82182, CVE-2026-19722) em fiscontau.com.br
Plugin desatualizado: wordpress-seo 28.3 → 28.5 (fiscontau.com.br)
Core WordPress difere do checksum da 20i (21 arquivo(s)) em fiscontau.com.br — provável drift de versão/idioma; o deep-scan confirma se é injeção