Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/09/2026

Vulnerabilidad XPS almacenado en Popup Maker para WordPress afecta versiones hasta 1.24.0

El plugin Popup Maker para WordPress es vulnerable a inyección de scripts (XSS almacenado) en el parámetro values[Name] hasta la versión 1.24.0, permitiendo que atacantes sin autenticación inyecten código malicioso en páginas públicas. Esta vulnerabilidad (CVSS 7.2) afecta directamente a tiendas en línea y sitios de generación de leads en LATAM que usan este plugin para captura de datos.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

Vulnerabilidad de Cross-Site Scripting Almacenado en Jeg Kit for Elementor hasta v3.2.16

El plugin Jeg Kit for Elementor para WordPress contiene una vulnerabilidad de Stored XSS (CVSS 7.2) que permite a atacantes no autenticados inyectar scripts maliciosos a través de contenido de comentarios. Los scripts se ejecutan cuando otros usuarios acceden a las páginas afectadas, comprometiendo datos de visitantes y administradores. Afecta todas las versiones hasta la 3.2.16, siendo alta en sitios de e-commerce y portales corporativos comunes en LATAM.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

Vulnerabilidad alta en Synology DSM permite escritura arbitraria de archivos (CVE-2026-6205)

Se ha identificado una vulnerabilidad de control externo de rutas de archivo en la API de carga de Synology DiskStation Manager que afecta versiones anteriores a 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 y 7.4-90075. Usuarios remotos autenticados pueden escribir archivos arbitrarios y ejecutar ataques de denegación de servicio. Con CVSS 8.1, representa riesgo alto para servidores NAS en empresas y centros de datos LATAM que almacenan datos altas.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

Vulnerabilidad XSS Almacenado en plugin Complianz GDPR/CCPA para WordPress (CVE-2026-83561)

El plugin Complianz GDPR/CCPA Cookie Consent Banner para WordPress contiene una vulnerabilidad de Cross-Site Scripting almacenado (XSS) en versiones hasta la 7.5.4. Atacantes no autenticados pueden inyectar scripts maliciosos a través del contenido de comentarios usando la expresión regular del bloqueador de cookies de Elementor. La falla resulta de validación insuficiente de entrada y escape inadecuado de salida. Empresas en México y LATAM que usen este plugin están en riesgo de comprometimiento de datos de visitantes y sesiones de usuarios.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

Vulnerabilidad alta de validación de certificados en Synology DiskStation Manager (DSM)

Una falla en la validación de certificados en la API de correo de Synology DSM permite ataques de intermediario (MITM) para leer/escribir archivos arbitrarios y ejecutar denegación de servicio. Afecta versiones previas a 7.2.1-69057-10, 7.2.2-72806-7 y 7.3.2-86009-2. En México y LATAM, esta vulnerabilidad es alta para empresas que utilizan DSM como servidor de almacenamiento conectado a redes corporativas con servicios de correo integrados.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/09/2026

Vulnerabilidad alta en Netty: fuga de memoria en StompSubframeDecoder (CVE-2026-93494)

Se identificó un fallo en el componente StompSubframeDecoder de Netty que permite a atacantes remotos provocar una fuga permanente de memoria mediante frames STOMP malformados sin byte nulo de terminación. La acumulación descontrolada de memoria puede derivar en Denegación de Servicio (DoS), afectando aplicaciones que utilizan este framework para procesamiento de mensajes en tiempo real, especialmente en plataformas de comercio electrónico, sistemas financieros y comunicaciones altas en la región.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-85705] The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and …

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already ex…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-89059] A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodie…

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-18442] The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to…

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append add…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-67102] HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, wh…

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-67103] HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could a…

HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-15275] The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the '…

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into alr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-92619] The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up t…

The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 11.8.2 via the `wpbc_ajax_option_save` AJAX action. The vulnerability exists because the `handle_ajax_save()` function applies per-option safeguards only to names explicitly registered via `register_option_policy()`, causing `get_option_policy()` to return an empty policy — bypassi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93485] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i…

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS. This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.1…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-88825] The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearan…

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and in the browser of any visitor to a page displaying the booking widget.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-90978] The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX ha…

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin before 1.1.5's stored gallery options.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-85127] The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type …

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-87767] The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and es…

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-87770] The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape para…

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-87771] The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape paramete…

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD