Content management systems were attacked three times more often than other Web applications -- especially WordPress, which was hit 3.5 times more often, according to Imperva's new Web Application Attacks Report.

WordPress, the most popular CMS, has taken a beating this year, marred by a variety of vulnerabilities -- particularly, weaknesses in plug-ins, of which the CMS has over 30,000 -- and an increase in brute-force attacks.

Imperva's report found that CMSes are far more susceptible to remote command execution (RCE) attacks than non-CMS applications. They further discovered that WordPress is five times likelier than other CMSes to be hit by remote file inclusion (RFI) attacks. 

"CMS frameworks are mostly open source, with communities of developers continuously generating sequences of plugins and add-ons, without concerted focus towards security. This developer model constantly increases the vulnerabilities in CMS applications, especially for WordPress which is also PHP based," the report said.

Healthcare applications, meanwhile, have less to worry about from RCE and RFI. Their main problem is, overwhelmingly, cross-site scripting (XSS). Fifty-seven percent of attacks against health apps are XSS, while other applications only get hit with XSS one- to 16% of the time. According to the report, XSS may be a popular way of stealing PII from healthcare apps by hijacking sessions.

Different industry verticals' apps are prone to different attacks. Travel, leisure, and financial services are hit hardest by RFI; computers/Internet and shopping by HTTP; and restaurants/dining by directory traversal attacks.

One thing nobody escaped from was Shellshock. The Shellshock RCE bug -- which grants remote command access to Linux- and Unix-based systems that use the Bash command shell -- showed up as a critical zero-day back in September 2014. Exploits appeared in the wild, and folded into exploit kits overnight.

Seven months later, in April 2015, Imperva saw another wave of attacks compromising Shellshock, which had not been patched, either.

"Shellshock attacks were detected in all applications in very similar numbers, indicating wide-scale blind scanning of the Internet with Shellshock attacks. ...  we saw that ShellShock scans were aimed at everyone without discrimination," according to the report. "The second wave, seven months after the publication of Shellshock, showed a wide and intensive campaign persistently attacking most of the applications in our research. During the campaign period, most of the applications were exposed to thousands of Shellshock attempts every single week."