Conoce las vulnerabilidades. Protege tus aplicaciones.

Alta 09.10.2026

CVE-2026-91136

Divi Plus <= 2.4.0 - Lectura arbitraria de archivos no autenticada mediante el parámetro 'svg_image'

Una vulnerabilidad en el complemento Divi Plus para WordPress permite a atacantes no autenticados leer archivos arbitrarios del servidor mediante un endpoint REST desprotegido.

WordPress

divi-plus

Alta 05.10.2026

CVE-2026-39725

Content Visibility for Divi Builder <= 5.03 - Authenticated (Contributor+) Remote Code Execution

WordPress

content-visibility-for-divi-builder

Crítica 01.10.2026

CVE-2026-19660

Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

WordPress

divi-membership

Crítica 01.10.2026

CVE-2026-19652

Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter

WordPress

divi-membership

Media 30.09.2026

CVE-2026-102384

Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.63 - Authenticated (Author+) Stored Cross-Site Scripting

WordPress

supreme-modules-for-divi

Media 21.09.2026

CVE-2026-14321

Divi Dash <= 1.0.6 - Unauthenticated IP Spoofing to Protection Bypass

WordPress

divi-dash

Media 18.09.2026

CVE-2026-15760

Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action

WordPress

divi-essential

Alta 18.09.2026

CVE-2026-87909

WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

WordPress

wp-photo-album-plus

Media 17.09.2026

CVE-2026-91707

Divi 5.0 - 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

WordPress

divi

Media 04.09.2026

CVE-2026-3853

Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

WordPress

divi

Media 04.09.2026

CVE-2026-4361

Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter

WordPress

divi

Crítica 03.09.2026

CVE-2026-11613

Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter

WordPress

divi-ajax-filter

Media 02.09.2026

CVE-2026-3852

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter

WordPress

divi

Media 01.09.2026

CVE-2026-3850

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter

WordPress

divi

Media 01.09.2026

CVE-2026-3851

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode

WordPress

divi

Media 30.08.2026

CVE-2026-14835

SOGO Add Script to Individual Pages Header Footer <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress

oh-add-script-header-footer

Media 15.08.2026

CVE-2026-13358

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure

WordPress

simply-schedule-appointments

Media 14.08.2026

CVE-2026-13712

Divi 5.0 - 5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress

divi

Alta 04.08.2026

7bbead7c-47b9-473f-b335-6fae4b5998d6

Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal

WordPress

contact-form-extender-for-divi-builder

Media 31.07.2026

CVE-2026-17580

Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints

WordPress

acf-views

Alta 23.07.2026

CVE-2026-10033

EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action

WordPress

eventon-action-user

Media 22.07.2026

CVE-2026-59543

Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… <= 3.8.11 - Authenticated (Subscriber+) Remote Code Execution

WordPress

acf-views

Media 10.07.2026

CVE-2026-3367

Lockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting

WordPress

lockme-calendars-integration

Alta 08.07.2026

CVE-2026-4275

Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint

WordPress

addons-for-divi