Media
CVE-2026-94670
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 8.950
Restablecer filtros
Alta
CVE-2026-95534
Unlimited Elements for Elementor <= 2.0.19 - Authenticated (Contributor+) PHP Object Injection
Alta
CVE-2026-103062
TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.6 - Unauthenticated Stored Cross-Site Scripting
Alta
CVE-2026-95606
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection
Media
CVE-2026-19856
All in One SEO <= 5.0.2.0 - Unauthenticated Arbitrary Shortcode Execution
Alta
CVE-2026-39600
Aculect AI Companion <= 0.8.2 - Missing Authorization to Unauthorized Redirects
Alta
CVE-2026-93430
GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX
Media
CVE-2026-39601
Booking Calendar <= 11.8.4 - Unauthenticated Duplicate Slot Booking
Crítica
CVE-2026-94541
WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter
Media
CVE-2026-85492
All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname
Baja
CVE-2026-102002
Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget
Alta
CVE-2026-96566
Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter
Alta
CVE-2026-96567
MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)
Media
CVE-2026-96647
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter
Media
CVE-2026-94432
Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
Alta
CVE-2026-100107
Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
Media
CVE-2026-93880
Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder
Media
CVE-2026-12951
MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter
Alta
CVE-2026-90438
Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
Alta
CVE-2026-92820
Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
Alta
CVE-2026-93875
JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter
Alta
CVE-2026-15897
Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
Alta
CVE-2026-92174
SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
Crítica
CVE-2026-15896
Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.