Conoce las vulnerabilidades. Protege tus aplicaciones.

Media 09.10.2026

CVE-2026-102291

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Ejecución arbitraria de shortcodes autenticada (Suscriptor+) mediante 'display_name'

El plugin Kirki para WordPress permite a atacantes autenticados con rol de Suscriptor o superior ejecutar shortcodes arbitrarios mediante el campo display_name en páginas que muestren contenido dinámico de usuarios.

WordPress

kirki

Alta 09.10.2026

CVE-2026-96278

WP Photo Album Plus <= 9.3.03.002 - Cross-Site Scripting almacenado no autenticado mediante el historial de sesión de REQUEST_URI

Una vulnerabilidad de Cross-Site Scripting almacenado en el plugin WP Photo Album Plus para WordPress permite a atacantes no autenticados inyectar scripts web arbitrarios a través del historial de sesión de REQUEST_URI.

WordPress

wp-photo-album-plus

Media 09.10.2026

CVE-2026-96574

User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter

WordPress

wp-user-frontend

Alta 09.10.2026

CVE-2026-96572

WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

WordPress

wp-meteor

Media 09.10.2026

CVE-2026-15178

Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification

WordPress

fluentform

Alta 09.10.2026

CVE-2026-12626

Plugin Bookly para WordPress <= 28.2 - Inyección autenticada de objetos PHP

El plugin Bookly para WordPress es vulnerable a la inyección de objetos PHP autenticada mediante el parámetro value. Atacantes con permisos de nivel personalizado o superior pueden inyectar objetos PHP, aunque actualmente no se conoce ninguna cadena de gadgets.

WordPress

bookly-responsive-appointment-booking-tool

Crítica 09.10.2026

CVE-2026-104801

PPOM <= 34.0.10 - Eliminación arbitraria de archivos no autenticada mediante el parámetro 'ppom[fields][<data_name>][n][org]'

Una vulnerabilidad en el complemento PPOM for WooCommerce permite a atacantes no autenticados eliminar y exponer archivos arbitrarios del servidor, lo que podría derivar en la ejecución remota de código.

WordPress

woocommerce-product-addon

Media 09.10.2026

CVE-2026-6243

Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

WordPress

acf-frontend-form-element

Alta 09.10.2026

CVE-2026-94538

WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions

WordPress

wp-file-download

Media 09.10.2026

CVE-2026-5725

Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix

WordPress

favicon-rotator

Media 09.10.2026

CVE-2026-3717

CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload

WordPress

cv-builder

Media 09.10.2026

CVE-2026-107712

WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter

WordPress

wp-booking-system

Media 09.10.2026

CVE-2026-89100

Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment

WordPress

woo-stripe-payment

Alta 09.10.2026

CVE-2026-100161

Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter

WordPress

woo-photo-reviews

Alta 09.10.2026

CVE-2026-95684

VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter

WordPress

vikbooking

Alta 09.10.2026

CVE-2026-107742

10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

WordPress

tenweb-speed-optimizer

Media 09.10.2026

CVE-2026-102402

Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode

WordPress

tlp-team

Alta 09.10.2026

CVE-2026-96840

Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field

WordPress

ultimate-post

Baja 09.10.2026

CVE-2026-104006

SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check

WordPress

speedycache

Media 09.10.2026

CVE-2026-97348

SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)

WordPress

so-widgets-bundle

Media 09.10.2026

CVE-2026-103427

Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field

WordPress

simple-membership

Alta 09.10.2026

CVE-2026-100196

LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

WordPress

rocket-lazy-load

Media 09.10.2026

CVE-2026-103897

Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute

WordPress

responsive-lightbox

Alta 09.10.2026

CVE-2026-96558

Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter

WordPress

quiz-master-next