Media
CVE-2025-14167
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.602
Media
CVE-2026-1047
salavat counter Plugin <= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parameter
Media
CVE-2026-1055
TalkJS <= 0.1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'welcomeMessage' Parameter
Media
CVE-2025-14076
iXML – Google XML sitemap generator <= 0.6 - Reflected Cross-Site Scripting via 'iXML_email' Parameter
Media
CVE-2026-2504
Dealia – Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset
Crítica
CVE-2026-1405
Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload
Media
CVE-2026-1373
Easy Author Image <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Picture URL
Media
CVE-2026-2282
Slidorion <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settings
Media
CVE-2026-2284
News Element Elementor Blog Magazine <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data Loss
Media
CVE-2026-1646
Advance Block Extend <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute
Alta
CVE-2026-0912
Toret Manager <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions
Crítica
CVE-2026-0926
Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]
Media
CVE-2026-1455
Whatsiplus Scheduled Notification for Woocommerce <= 1.0.1 - Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX Action
Media
CVE-2025-14357
Mega Store Woocommerce <= 6.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change
Crítica
CVE-2025-13563
Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation
Media
CVE-2026-1043
PostmarkApp Email Integrator <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Alta
CVE-2026-0974
Orderable <= 1.20.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
Media
CVE-2025-13864
Breeze – WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache Deletion
Crítica
CVE-2025-13851
Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration
Media
CVE-2025-13413
Country Blocker for AdSense <= 1.0 - Cross-Site Request Forgery to Settings Update
Media
CVE-2025-13438
Page Title, Description & Open Graph Updater <= 1.02 - Cross-Site Request Forgery to Arbitrary Page Title Modification
Media
CVE-2025-13617
Apollo13 Framework Extension <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter
Media
CVE-2025-13587
Two Factor (2FA) Authentication via Email <= 1.9.8 - Two-Factor Authentication Bypass via token
Media
CVE-2026-27100
Jenkins has a build information disclosure vulnerability through Run Parameter
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.