Alta
CVE-2026-12800
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 391
Restablecer filtros
Media
CVE-2026-16603
Content Protector (Passster) <= 4.3.5 - Unauthenticated Category-Locked Content Disclosure
Media
CVE-2026-16293
Blubrry PowerPress <= 11.16.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Media
CVE-2026-13464
Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Alta
CVE-2026-9713
Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload
Media
CVE-2026-57699
Slider Pro <= 4.8.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Media
CVE-2026-15349
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler
Media
CVE-2026-15099
WP Delicious <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
Media
CVE-2026-13767
Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter
Media
CVE-2026-12434
List category posts <= 0.95.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post_status' Shortcode Attribute
Media
CVE-2026-59522
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.5 - Missing Authorization
Media
CVE-2026-12385
Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
Alta
CVE-2026-57767
WP Google Maps Pro <= 10.1.02 - Cross-Site Scripting almacenado no autenticado
El plugin WP Google Maps Pro para WordPress es vulnerable a Cross-Site Scripting almacenado por falta de saneamiento y escape de datos, permitiendo a atacantes no autenticados inyectar scripts en páginas que se ejecutan al visitarlas.
Alta
CVE-2026-15070
Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter
Media
CVE-2026-57807
WordPress Single Sign-On (SSO) - Multisite Premium <= 38.5.8 - Missing Authorization
Media
CVE-2026-12418
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter
Media
CVE-2026-13011
ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter
Alta
CVE-2026-57410
MailerPress – Newsletter, email marketing & AI automation <= 2.0.2 - Authenticated (Contributor+) Privilege Escalation
Alta
CVE-2026-9148
Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field
Media
CVE-2026-10089
Insert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)
Crítica
CVE-2026-15158
Blocksy Companion <= 2.1.46 - Subida no autenticada de archivos arbitrarios a través del parámetro 'blc-review-images[]'
Una vulnerabilidad crítica en Blocksy Companion permite a atacantes no autenticados subir archivos arbitrarios, lo que puede provocar la ejecución remota de código si la versión premium tiene activas extensiones específicas.
Crítica
CVE-2026-5524
Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
Alta
CVE-2026-11823
BookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection via 'store_service_date' Parameter
Media
CVE-2026-13246
GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.