Alta
CVE-2026-66650
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.681
Restablecer filtros
Alta
CVE-2026-66672
Flatastic <= 2.0 - Unauthenticated PHP Object Injection
Crítica
CVE-2026-32475
Elementor Pro <= 4.2.1 - Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass
Media
CVE-2026-74012
Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms <= 3.51.0 - Authenticated (Editor+) PHP Object Injection
Alta
CVE-2026-73364
Flexible Subscriptions <= 1.8.1 - Authenticated (Customer+) PHP Object Injection
Alta
CVE-2026-73389
Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injection
Alta
CVE-2026-73993
FundEngine – Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection
Alta
CVE-2026-66583
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.0 - Unauthenticated PHP Object Injection
Alta
CVE-2026-19942
Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
Crítica
CVE-2026-18315
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
Alta
CVE-2026-73380
Smart Popup by Supsystic <= 1.13.0 - Unauthenticated PHP Object Injection
Media
CVE-2026-66620
OptionTree <= 2.7.3 - Authenticated (Editor+) PHP Object Injection
Alta
CVE-2026-73397
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated PHP Object Injection
Alta
CVE-2026-73341
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.7 - Unauthenticated PHP Object Injection
Alta
CVE-2026-73376
Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated PHP Object Injection
Alta
CVE-2026-73366
Easy Google Maps <= 1.13.0 - Unauthenticated PHP Object Injection
Media
CVE-2026-13174
Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion
Media
CVE-2026-13169
Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover
Crítica
CVE-2024-13784
Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection
Media
CVE-2026-18347
Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
Media
CVE-2026-10035
Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection
Media
CVE-2026-18385
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field
Media
CVE-2026-15009
Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter
Media
CVE-2026-13167
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.