Even a browser driveby attack is wormable if you use various social media for spreading.

Few vaguely reliable RCE bugs aren’t wormable. Even ones requiring significant user interaction are wormable, office macros are wormable.

Workable bugs are far more common than actual worms.