Alta
CVE-2026-19807
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 8.950
Restablecer filtros
Crítica
CVE-2026-15989
Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
Crítica
CVE-2026-75957
Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
Alta
CVE-2026-93882
LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
Alta
CVE-2026-96561
AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
Media
CVE-2026-91109
Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
Alta
CVE-2026-92245
Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
Media
CVE-2026-92537
Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
Media
CVE-2026-102392
Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 - Authenticated (Shop Manager+) PHP Object Injection
Alta
CVE-2026-100512
Nested Pages <= 3.3.2 - Authenticated (Contributor+) PHP Object Injection
Alta
CVE-2026-97291
Schema & Structured Data for WP & AMP <= 1.66 - Authenticated (Contributor+) PHP Object Injection
Alta
CVE-2026-102377
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.46 - Authenticated (Contributor+) PHP Object Injection
Media
CVE-2026-97256
Page Builder by SiteOrigin <= 2.36.0 - Authenticated (Editor+) PHP Object Injection
Alta
CVE-2026-102385
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
Crítica
CVE-2026-94389
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Remote Code Execution
Media
CVE-2026-97318
Giveaways and Contests by RafflePress <= 1.12.26 - Unauthenticated Open Redirect
Media
CVE-2026-97282
SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO <= 3.1.0 - Unauthenticated Insecure Direct Object Reference
Media
CVE-2026-97274
OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 - Unauthenticated Authentication Bypass
Media
CVE-2026-97317
Giveaways and Contests by RafflePress <= 1.12.26 - Unauthenticated Information Exposure
Media
CVE-2026-62078
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting
Alta
CVE-2026-100508
Two Factor <= 0.16.0 - Unauthenticated Denial of Service
Media
CVE-2026-62083
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Subscriber+) Free Paid Course Enrollment
Media
CVE-2026-97074
Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Alta
CVE-2026-75098
Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.