Vulnerabilidades — Alertas SI

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52919] In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix tp_meter counte…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix tp_meter counter underflow during shutdown batadv_tp_sender_shutdown() unconditionally decrements the "sending" atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1. Since the sender logic treats any non-zero value as "still sending"…

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52920] In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix stric…

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume info->pol[] in the same forward order as the rule layout. Derive the strict-match policy position from the number of transforms already cons…

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52912] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridg…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only holds references on state.in/out and bridge physdevs, so a queued bridge packet can retain a freed bridge master in skb->dev until reinjectio…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9643] The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting vi…

The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin's `wpmsTemplateRedirect()` hook detects a 404, it concatenates `$_SERVER['HTTP_HOST']` with the raw `$_SERVER['REQUEST_URI']` and inserts that value verbatim into the `wp_wpms_links.link_url` column via `…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9709] The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST …

The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone W…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9710] The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-p…

The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to every logged-in user on any wp-admin page, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata including raw password hashes. This affects the premium co C…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9178] The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up…

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/ (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a '…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9179] The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter…

The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() functi…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-8705] The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` …

The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in all versions up to, and including, 3.4.2. The handler is registered for unauthenticated users (`wp_ajax_nopriv_clearsale_total_push`), and although a `wp_verify_nonce()` check exists, the failing branch's `die()` is commented out so executi…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-4297] The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in al…

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() (verifying credentials are valid) but does not perform any authori…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-12095] The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up…

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The script echoes internal API response d…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-12100] The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up…

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12416] The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in a…

The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and performing a loose equality comparison between the supplied `reset_activation_code` POST parame…

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12417] The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Re…

The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0. This is due to the `pravel_change_password()` AJAX handler — registered via `wp_ajax_nopriv_pravel_change_password` and therefore accessible to unauthenticated users — performing no nonce verification, no capability …

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10091] The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email' shortcode in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10092] The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scriptin…

The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cincopa Shortcode in Post Comments in all versions up to, and including, 1.163 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. …

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10735] Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress pl…

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code throug…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10749] The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during po…

The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP Object.

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12850] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12851] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?