Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/09/2026

Vulnerabilidad alta en tema Nokri Job Board para WordPress permite escalada de privilegios

El tema WordPress Nokri – Job Board (versiones hasta 1.6.4) contiene una falta de validación de permisos en la función 'nokri_account_member_permissions', permitiendo a usuarios autenticados con acceso de Suscriptor crear nuevos usuarios con permisos de empleador. Esta vulnerabilidad afecta especialmente a plataformas de empleo y bolsas de trabajo en LATAM que utilizan este tema para gestionar portales de reclutamiento.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/09/2026

Escalación de privilegios alta en plugin Abandoned Cart Pro para WooCommerce

El plugin Abandoned Cart Pro para WordPress contiene una vulnerabilidad de escalación de privilegios (CVSS 8.8) que afecta todas las versiones hasta la 10.7.1. Usuarios autenticados pueden ejecutar acciones administrativas sin verificación de capacidades o nonces, comprometiendo tiendas de comercio electrónico en la región. La vulnerabilidad impacta acciones AJAX altas de configuración y envío de correos, exponiendo datos sensibles de clientes y carros abandonados.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/09/2026

Vulnerabilidad alta de XSS almacenado en plugin Contact Form by Supsystic para WordPress

El plugin Contact Form by Supsystic (versiones hasta 1.10.2) contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado que permite a atacantes no autenticados inyectar código malicioso a través del encabezado de dirección IP. Esto afecta a miles de sitios WordPress en LATAM que usan este plugin, exponiendo datos de usuarios y permitiendo comprometer la integridad de formularios de contacto. La vulnerabilidad tiene CVSS 7.2, indicando riesgo alto para empresas que recopilan información sensible a través de estos formularios.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-77830] The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored C…

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-78438] The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Con…

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Thi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-18406] The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is …

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-19769] The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to…

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will ex…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-19887] The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up…

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chose…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-15984] The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Para…

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenti…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-16649] The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Fi…

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-77233] The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu…

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execu…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-77263] The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu…

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesse…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-12483] The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up…

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash_fileupload_process' function, which iterates through an entire array and validates only the first file. This makes it possible for authenticated attackers, with subscriber-level access and above who are enrolled …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-16281] The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can ed…

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19224] The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting…

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2025-15485] The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its RES…

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

02/09/2026

Vulnerabilidad CSRF alta en Mang Board WP versiones ≤2.3.8 permite ataques no autenticados

Se ha identificado una vulnerabilidad de Falsificación de Solicitud entre Sitios (CSRF) no autenticada en el plugin Mang Board WP hasta la versión 2.3.8, con puntuación CVSS 8.8. Esta falla permite a atacantes realizar acciones maliciosas en sitios WordPress afectados sin requerir credenciales, poniendo en riesgo la integridad de contenido, datos de usuarios y configuraciones administrativas en empresas de México y Latinoamérica que dependen de este plugin.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

Inyección de objetos PHP sin autenticación en Ninja Forms - Layout & Styles ≤ 3.0.31

Se ha identificado una vulnerabilidad alta de inyección de objetos PHP sin autenticación en el plugin Ninja Forms - Layout & Styles en versiones 3.0.31 y anteriores. Los atacantes pueden explotar esta falla para ejecutar código malicioso en servidores web, afectando principalmente a sitios WordPress en México y LATAM que utilizan este complemento. La vulnerabilidad tiene un score CVSS de 8.8, indicando riesgo alta de comprometimiento de integridad y disponibilidad.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

Exposición de datos sensibles sin autenticación en WooCommerce Product Attachment ≤ 2.3.3

WooCommerce Product Attachment versión 2.3.3 y anteriores contiene una vulnerabilidad que permite a atacantes acceder a datos sensibles sin requerir autenticación, con puntuación CVSS 7.5. Esta exposición afecta principalmente a tiendas en línea operadas en México y Latinoamérica que utilizan este plugin en WordPress. El riesgo se amplifica en entornos de comercio electrónico que manejan información de clientes, productos o transacciones.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-75528] The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Commen…

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation req…

nvdaltovulnerabilidad CVSS 7.2 NVD