Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 20434 resultados ✕ Limpiar búsqueda
26,227
Total alertas
5270
Críticas
20093
Altas
8
Ransomware
1760
Esta semana
RSS
Vulnerabilidades × Limpiar todo ×
M Crítico vulnerabilidad
11/10/2026
[CVE-2026-84253] The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation an…
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new admin…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
11/10/2026
[CVE-2026-84254] The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation a…
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new adm…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
11/10/2026
[CVE-2026-84258] The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape con…
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/10/2026
[CVE-2026-84259] The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content…
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/10/2026
[CVE-2026-84260] The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape c…
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/10/2026
[CVE-2026-84261] The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape …
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
11/10/2026
[CVE-2026-84734] The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied …
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
11/10/2026
[CVE-2026-84737] The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when a…
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
11/10/2026
[CVE-2026-85118] The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capabi…
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
11/10/2026
[CVE-2026-14854] The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before …
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
11/10/2026
[CVE-2026-81420] The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it…
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Crítico vulnerabilidad
11/10/2026
[CVE-2026-81649] The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on sev…
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark …
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
11/10/2026
[CVE-2026-84251] The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and …
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administr…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
11/10/2026
[CVE-2026-84252] The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF…
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator acc…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
11/10/2026
[CVE-2026-108540] A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the fi…
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
nvdcriticovulnerabilidad CVSS 9.9 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
11/10/2026
[CVE-2026-103694] The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a …
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/10/2026
[CVE-2026-103695] The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before us…
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Crítico vulnerabilidad
11/10/2026
[CVE-2026-104028] The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce ver…
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
11/10/2026
[CVE-2026-104680] The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability …
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to …
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
11/10/2026
[CVE-2026-106029] The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity …
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.
nvdaltovulnerabilidad CVSS 7.5 NVD