Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/10/2026

[CVE-2026-94256] The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the…

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-94257] The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being chang…

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-77183] The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege e…

The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with FooSales Cashier-level access and above, to change arb…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-83526] The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, a…

The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIME or extension check, combined with a missing capability check on new player cre…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-87780] The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted…

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-87781] The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter befo…

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-14335] The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is …

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104766] The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres…

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` p…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104899] The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre…

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. Thi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104752] The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file up…

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104723] The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable t…

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vuln…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104725] The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Pr…

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the `user` parameter within the `process_edit()` function, which allows any authenticated user with the `edit_contacts` capability to reassign a contact record's linked WordPress u…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-89301] The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file…

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe files on the server.. The public nonce (rtmedia_upload_nonce) is emitted into frontend JavaScript on a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104021] The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to,…

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the `fastcache_settings[cache_cookie_exclude][]` parameter. This is due to the plugin registering the `cache_cookie_exclude` setting via `register_setting()` without a `sanitize_callback`, while `buildSiteHtaccessRules()` applies only `trim()` to each cookie value before in…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104797] The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Aut…

The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions up to, and including, 2.9.0 The `adfoin_ultimatememberac_send_data` function, which powers the Ultimate Member "Update Profile Field" action, resolves the target WordPress user from an attacker-supplied email address and passes an att…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-92705] Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loa…

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS`  file execute…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-57458] Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token…

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API t…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-62376] Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store passwo…

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-108259] Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values f…

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name c…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-108260] Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/…

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's …

nvdaltovulnerabilidad CVSS 7.6 NVD