Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/09/2026

[CVE-2026-81737] The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by u…

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute in the context of a logged in administrator.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-81807] The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before r…

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-82183] The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion retur…

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-77792] The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field val…

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-80467] The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role subm…

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-19723] The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properl…

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPr…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-14357] The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and in…

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary t…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-19116] The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from b…

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-19453] The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the acco…

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-12526] The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the reques…

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing ad…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-12865] The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters be…

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScrip…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-14982] The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficie…

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-10195] The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and incl…

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to exec…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19513] The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to,…

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This m…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19914] The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cu…

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected paylo…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19573] The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via …

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19796] The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vul…

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19806] The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin …

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19952] The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due t…

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-conf…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-75921] The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widge…

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload_template_kit function. This is due to incorrect authorization on the upload_template_kit() AJAX handler, which requires only upload_files capability instea…

nvdaltovulnerabilidad CVSS 7.2 NVD