Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1051
Esta semana
RSS
Vulnerabilidades × cwe-79 × Limpiar todo ×
M Alto vulnerabilidad
01/09/2026
[CVE-2026-19796] The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vul…
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a …
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82221] Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.
Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82224] Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.
Unauthenticated Cross Site Scripting (XSS) in SliceWP
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82229] Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81764] Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Email Essentials
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81765] Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81768] Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81291] Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
Unauthenticated Cross Site Scripting (XSS) in Uncode
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81298] Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
Unauthenticated Cross Site Scripting (XSS) in LeadConnector
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81290] Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/08/2026
[CVE-2026-82653] SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where u…
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.
nvdaltovulnerabilidad CVSS 8.9 NVD
M Alto vulnerabilidad
30/08/2026
[CVE-2026-82654] SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, …
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.
nvdaltovulnerabilidad CVSS 8.9 NVD
M Alto vulnerabilidad
30/08/2026
[CVE-2026-82642] Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter H…
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on elements, treating it as an opaque string attribute…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-81760] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-6176] The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripti…
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The plugin accepts review submissions from unauthenticated users through the 'cr_local_forms_submit' AJAX act…
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
28/08/2026
[CVE-2026-5934] The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, a…
The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected p…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-6286] The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stor…
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. While the plugin applies saniti…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-40541] An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilit…
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-76053] The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulner…
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-77365] The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin f…
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t…
nvdaltovulnerabilidad CVSS 7.2 NVD