Media
CVE-2026-57355
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 8.950
Restablecer filtros
Media
CVE-2026-5348
Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure
Media
CVE-2026-57720
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More <= 6.3.2 - Missing Authorization
Media
CVE-2026-57348
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.4 - Unauthenticated Server-Side Request Forgery
Crítica
CVE-2026-5524
Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
Media
CVE-2026-57357
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization <= 2.6.6 - Reflected Cross-Site Scripting
Media
CVE-2026-57362
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 - Reflected Cross-Site Scripting
Alta
CVE-2026-13228
LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter
Media
CVE-2026-12408
Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter
Crítica
CVE-2026-11387
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
Media
CVE-2026-12435
Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
Alta
CVE-2026-1239
Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
Media
CVE-2026-11981
GiveWP <= 4.15.3 - Cross-Site Request Forgery
Media
CVE-2026-12113
Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
Crítica
CVE-2026-6070
WP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter
Media
CVE-2026-12127
WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
Alta
CVE-2026-13731
WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
Alta
CVE-2026-13468
Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint
Alta
CVE-2026-12923
Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter
Media
CVE-2026-12904
Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter
Media
CVE-2026-13246
GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute
Alta
CVE-2026-13693
Bit Form <= 3.0.0 - Unauthenticated Arbitrary File Read
Alta
CVE-2026-27414
Werkstatt - Creative Portfolio WordPress Theme <= 4.8.3 - Authenticated (Contributor+) PHP Object Injection
Alta
CVE-2026-27060
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.5 - Authenticated (Contributor+) PHP Object Injection
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.