Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/09/2026

[CVE-2026-69417] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-69402] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-69356] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86738] Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to …

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

08/09/2026

Vulnerabilidad alta en SiYuan anterior a 3.8.2 permite ejecución de código remoto

SiYuan versiones anteriores a 3.8.2 presentan una vulnerabilidad de ejecución de código remoto (CVSS 8.8) que permite a atacantes ejecutar scripts maliciosos con acceso completo a Node.js cuando usuarios pegan contenido desde el portapapeles. La falla radica en que la aplicación no valida el tipo MIME personalizado text/siyuan antes de procesar datos pegados en el renderizador Electron. Empresas en LATAM que utilizan SiYuan como herramienta de gestión de conocimiento o notas en equipos de desarrollo están expuestas a compromiso completo del sistema operativo.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81798] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-84817] Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-84818] Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.

Unauthenticated Cross Site Scripting (XSS) in Open User Map

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-84820] Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons…

Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86431] league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scrip…

league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\x0Conclick="alert(1)"}) bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter because PHP's trim() does not strip U+000C, causing the attribute to be written …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-6431] The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugi…

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

06/09/2026

Vulnerabilidad de XSS almacenado en plugin Kirki para WordPress anterior a v6.3.0

El plugin Kirki para WordPress anterior a la versión 6.3.0 no valida correctamente las entidades HTML, permitiendo que usuarios no autenticados inyecten JavaScript malicioso en comentarios. El código ejecutado afecta a visitantes y administradores en todas las páginas que muestren comentarios, incluyendo encabezados y pies de página.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-86188] AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthen…

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

Vulnerabilidad alta de XSS almacenado en plugin Contact Form by Supsystic para WordPress

El plugin Contact Form by Supsystic (versiones hasta 1.10.2) contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado que permite a atacantes no autenticados inyectar código malicioso a través del encabezado de dirección IP. Esto afecta a miles de sitios WordPress en LATAM que usan este plugin, exponiendo datos de usuarios y permitiendo comprometer la integridad de formularios de contacto. La vulnerabilidad tiene CVSS 7.2, indicando riesgo alto para empresas que recopilan información sensible a través de estos formularios.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-77830] The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored C…

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-78438] The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Con…

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Thi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-18406] The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is …

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-19769] The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to…

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will ex…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-15984] The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Para…

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenti…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-16649] The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Fi…

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time…

nvdaltovulnerabilidad CVSS 7.2 NVD