Crítica
CVE-2026-0926
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 8.950
Restablecer filtros
Crítica
CVE-2025-13563
Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation
Media
CVE-2026-1043
PostmarkApp Email Integrator <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Media
CVE-2025-13587
Two Factor (2FA) Authentication via Email <= 1.9.8 - Two-Factor Authentication Bypass via token
Alta
CVE-2025-13603
WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation
Alta
CVE-2025-12975
CTX Feed – WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation
Crítica
CVE-2025-12882
Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation
Media
CVE-2025-12172
Mailchimp List Subscribe Form <= 2.0.0 - Cross-Site Request Forgery to Mailchimp List Change
Alta
CVE-2025-11754
Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.1.2 - Missing Authorization to Sensitive Information Exposure
Media
CVE-2026-2386
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'
Media
CVE-2025-13113
Web Accessibility by accessiBe <= 2.11 - Unauthenticated Sensitive Information Exposure
Alta
CVE-2025-12845
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation
Alta
CVE-2026-23544
Valenti <= 5.6.3.5 - Authenticated (Contributor+) PHP Object Injection
Media
CVE-2025-13842
Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure
Media
CVE-2025-13079
Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens
Media
CVE-2026-23541
Mail Mint <= 1.19.4 - Missing Authorization
Media
CVE-2025-13612
Album and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
Media
CVE-2025-12448
Smartsupp – live chat, AI shopping assistant and chatbots <= 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Alta
CVE-2026-23549
WpEvently <= 5.1.1 - Unauthenticated PHP Object Injection
Alta
CVE-2025-15041
BackWPup 5.0.0 - 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update
Media
CVE-2025-12027
Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update
Alta
CVE-2026-23542
Grand Restaurant <= 7.0.10 - Unauthenticated PHP Object Injection
Media
CVE-2025-14294
Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification
Alta
CVE-2026-32384
WpBookingly <= 1.2.9 - Authenticated (Contributor+) Local File Inclusion
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.