Alertas de Seguridad de la Información

M Alto vulnerabilidad

09/09/2026

[CVE-2026-75927] The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus…

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-83593] The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulner…

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-84068] The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before u…

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-76009] The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication By…

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-14962] The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and es…

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-16960] The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to…

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-84293] The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Script…

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected p…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-17553] The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and in…

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's bui…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-76801] The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin fo…

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToRun() that fails to block WordPress core functions such as wp_insert_user, update_option, and file_put_c…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-15406] The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPres…

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-15667] The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPres…

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execut…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-13359] The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress …

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/09/2026

Plugin Event Tickets and Registration para WordPress vulnerable a modificación no autorizada de credenciales Stripe

El plugin Event Tickets and Registration en WordPress (versiones hasta 5.27.4) presenta una falla alta de validación de permisos en el endpoint de retorno OAuth de Stripe, permitiendo que atacantes no autenticados sobrescriban credenciales del comerciante (tokens de acceso, claves públicas e ID de cuenta). Esto afecta directamente a tiendas en línea, plataformas de eventos y sitios de registro en México y LATAM que procesan pagos a través de Stripe.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

Vulnerabilidad alta en Live Composer para WordPress permite inyección de objetos PHP

El plugin Live Composer (versiones hasta 2.1.18) en WordPress es vulnerable a inyección de objetos PHP mediante deserialización de datos no confiables. Atacantes autenticados con acceso de colaborador pueden explotar esta falla para ejecutar código malicioso. Afecta especialmente a sitios pequeños y medianos en LATAM que usan este constructor visual sin actualizar regularmente.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

Plugin EDD Product Catalog Feed para WordPress vulnerable a eliminación no autorizada de datos

El plugin EDD Product Catalog Feed by PixelYourSite en WordPress (versiones hasta 1.0.2) contiene una falta de validación de permisos en la función wpeddpcf_delete_feed, permitiendo a usuarios autenticados con acceso de suscriptor o superior eliminar valores de opciones arbitrarias. Esto puede provocar denegación de servicio y corrupción de datos altas en tiendas en línea y plataformas de comercio electrónico en LATAM.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-14444] The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to…

The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, and who possess the access_key, to create a new u…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-6431] The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugi…

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

06/09/2026

Vulnerabilidad alta en SureCart (WordPress) permite escalada de privilegios y takeover de cuentas

El plugin SureCart para WordPress en versiones anteriores a 4.6.3 contiene una falla de validación que permite a usuarios con permisos de suscriptor modificar direcciones de correo de otros usuarios, incluidos administradores, y tomar control de sus cuentas mediante reset de contraseña. Esta vulnerabilidad afecta directamente a tiendas en línea y plataformas de comercio electrónico operadas en México y Latinoamérica que usan este plugin.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/09/2026

Vulnerabilidad de XSS almacenado en plugin Kirki para WordPress anterior a v6.3.0

El plugin Kirki para WordPress anterior a la versión 6.3.0 no valida correctamente las entidades HTML, permitiendo que usuarios no autenticados inyecten JavaScript malicioso en comentarios. El código ejecutado afecta a visitantes y administradores en todas las páginas que muestren comentarios, incluyendo encabezados y pies de página.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/09/2026

[CVE-2026-18056] The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the acc…

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access_token to the Facebook Graph API and trusting the returned email and ID verbatim, without p…

nvdaltovulnerabilidad CVSS 7.5 NVD