Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/06/2026

[CVE-2026-7761] The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link D…

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: (1) an MD5 hash fallback in get_directory_by_hash() that allows any post to be used as a member directory by computing SUBSTRING(MD5(post_id), 11, 5), (2) a strstr() parsing logic flaw in post_data() th…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9643] The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting vi…

The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin's `wpmsTemplateRedirect()` hook detects a 404, it concatenates `$_SERVER['HTTP_HOST']` with the raw `$_SERVER['REQUEST_URI']` and inserts that value verbatim into the `wp_wpms_links.link_url` column via `…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9709] The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST …

The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone W…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9710] The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-p…

The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to every logged-in user on any wp-admin page, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata including raw password hashes. This affects the premium co C…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9178] The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up…

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/ (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a '…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9179] The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter…

The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() functi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-8705] The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` …

The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in all versions up to, and including, 3.4.2. The handler is registered for unauthenticated users (`wp_ajax_nopriv_clearsale_total_push`), and although a `wp_verify_nonce()` check exists, the failing branch's `die()` is commented out so executi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-4297] The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in al…

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() (verifying credentials are valid) but does not perform any authori…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-12095] The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up…

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The script echoes internal API response d…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-12100] The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up…

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10091] The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email' shortcode in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10092] The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scriptin…

The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cincopa Shortcode in Post Comments in all versions up to, and including, 1.163 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10735] Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress pl…

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code throug…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10749] The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during po…

The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP Object.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-3652] The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value` parame…

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value` parameter of the `arf_save_incomplete_form_data` AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator views the "P…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-8172] The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input …

The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-8379] The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce c…

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-8163] The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some param…

The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-8157] The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned…

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-4259] The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a p…

The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

nvdaltovulnerabilidad CVSS 7.1 NVD