Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad Stored DOM XSS alta en plugin Visitor Traffic Real Time Statistics para WordPress

El plugin Visitor Traffic Real Time Statistics para WordPress es vulnerable a inyección de scripts almacenados a través del encabezado HTTP 'X-Real-IP' en todas las versiones hasta la 8.16. Atacantes no autenticados pueden inyectar código malicioso que se ejecuta cuando usuarios acceden a páginas comprometidas. Esta vulnerabilidad afecta directamente a sitios WordPress en LATAM que dependen de este plugin para analíticas de tráfico en tiempo real.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad XPS almacenado en plugin Strong Testimonials para WordPress (CVE-2026-96650)

El plugin Strong Testimonials versión 3.3.11 y anteriores contiene una vulnerabilidad de Cross-Site Scripting (XPS) almacenado en el campo personalizado 'platform_user_photo' debido a sanitización insuficiente. Atacantes no autenticados pueden inyectar código malicioso que se ejecutará cuando usuarios accedan a páginas comprometidas. Afecta principalmente a sitios WordPress en producción sin validación de entrada en campos de testimonios.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad alta en Simple Membership para WordPress permite modificación no autorizada de datos

El plugin Simple Membership para WordPress (versiones hasta 4.8.3) contiene una vulnerabilidad que permite a atacantes no autenticados modificar datos y acceder a información sensible a través de los endpoints resend-activation y email-activation. La falta de validación de autenticación, nonce y permisos en estas funciones expone a miles de sitios WordPress en LATAM que utilizan este plugin gratuito para gestionar membresías.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad de XSS almacenado en plugin SEOPress para WordPress afecta versiones hasta 10.2

El plugin SEOPress para WordPress es vulnerable a inyección de scripts maliciosos (XSS almacenado) a través del campo de nombre de autor, permitiendo a atacantes sin autenticación ejecutar código arbitrario en páginas afectadas. La vulnerabilidad impacta todos los sitios WordPress que utilicen versiones 10.2 o anteriores del plugin, especialmente aquellos con múltiples usuarios o perfiles públicos visibles.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad XMS almacenado alta en plugin Transliterator para WordPress

El plugin The Transliterator (versiones hasta 2.5.8) para WordPress presenta una vulnerabilidad de Cross-Site Scripting (XSS) almacenado que permite a atacantes no autenticados inyectar código malicioso a través de comentarios. La falla radica en insuficiente sanitización de entrada y escapado de salida en placeholders predecibles {rstr_keep}. Afecta directamente a sitios WordPress en LATAM con comentarios públicos habilitados, exponiendo datos de visitantes y administradores.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad XLS almacenado en GD Rating System para WordPress afecta sitios sin autenticación

El plugin GD Rating System (versiones ≤3.7.1) contiene un fallo de validación en los parámetros 'title' y 'url' del manejador AJAX gdrts_live_handler, permitiendo inyección de scripts maliciosos sin requerir autenticación. Los atacantes pueden ejecutar código arbitrario en el navegador de visitantes, comprometiendo sesiones administrativas, robando credenciales o redirigiendo tráfico. Afecta especialmente a sitios de e-commerce y plataformas de opiniones en LATAM.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-88783] The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed H…

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administr…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-89236] The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters befo…

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-87091] The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlem…

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The IPN endp…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-101928] The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Script…

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is p…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-103514] The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it…

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-101159] The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews s…

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-101160] The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review ratin…

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-101161] The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from sto…

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-92977] The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored …

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Maliciou…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-96270] The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Mem…

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-104433] Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readStrin…

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference serve…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-94591] Armatura One stores database and message-broker credentials in an install configuration file, encryp…

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, a…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-94592] Armatura One's database initialization routine assigns a fixed, vendor-defined password to the datab…

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can authenticate as the database superuser on a deployment where it has not been changed.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-97212] The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows mu…

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend…

nvdaltovulnerabilidad CVSS 7.3 NVD