Crítica
CVE-2026-13001
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 4.498
Restablecer filtros
Media
CVE-2026-14834
Mailgun for WordPress <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Mailgun List Subscription
Alta
CVE-2026-9282
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
Media
CVE-2026-12994
WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller
Alta
CVE-2026-15155
Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection
Alta
CVE-2025-6784
Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution
Alta
CVE-2026-2354
Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files()
Alta
CVE-2026-3576
Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
Alta
CVE-2026-15338
LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting
Alta
CVE-2026-13353
WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter
Media
CVE-2026-11426
UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter
Media
CVE-2025-11977
HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion
Media
CVE-2026-15104
BetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter
Alta
CVE-2026-13347
Hide My WP Lite <= 1.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter
Media
CVE-2026-12123
All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter
Alta
CVE-2026-15070
Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter
Alta
CVE-2026-13492
UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field
Alta
CVE-2026-57710
WoowBot Pro Max <= 14.1.7 - Authenticated (Subscriber+) Arbitrary File Upload
Crítica
CVE-2026-57811
Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Remote Code Execution
Crítica
CVE-2026-57719
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.3 - Unauthenticated Arbitrary File Upload
Crítica
CVE-2026-57709
Membership For WooCommerce <= 3.1.0 - Unauthenticated Arbitrary File Deletion
Alta
CVE-2026-14372
Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter
Crítica
CVE-2026-14245
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter
Media
CVE-2026-8996
Backup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.