Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 1 hora
22,162
Total alertas
4698
Críticas
16876
Altas
8
Ransomware
1037
Esta semana
RSS
Alta × cwe-79 × Limpiar todo ×
M Alto vulnerabilidad
06/09/2026
Vulnerabilidad de XSS almacenado en plugin Kirki para WordPress anterior a v6.3.0
El plugin Kirki para WordPress anterior a la versión 6.3.0 no valida correctamente las entidades HTML, permitiendo que usuarios no autenticados inyecten JavaScript malicioso en comentarios. El código ejecutado afecta a visitantes y administradores en todas las páginas que muestren comentarios, incluyendo encabezados y pies de página.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
05/09/2026
[CVE-2026-86188] AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthen…
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
05/09/2026
Vulnerabilidad alta de XSS almacenado en plugin Contact Form by Supsystic para WordPress
El plugin Contact Form by Supsystic (versiones hasta 1.10.2) contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado que permite a atacantes no autenticados inyectar código malicioso a través del encabezado de dirección IP. Esto afecta a miles de sitios WordPress en LATAM que usan este plugin, exponiendo datos de usuarios y permitiendo comprometer la integridad de formularios de contacto. La vulnerabilidad tiene CVSS 7.2, indicando riesgo alto para empresas que recopilan información sensible a través de estos formularios.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
05/09/2026
[CVE-2026-77830] The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored C…
The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that …
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
05/09/2026
[CVE-2026-78438] The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Con…
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Thi…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
05/09/2026
[CVE-2026-18406] The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is …
The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whe…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
05/09/2026
[CVE-2026-19769] The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to…
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will ex…
nvdaltovulnerabilidad CVSS 7.2 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
05/09/2026
[CVE-2026-15984] The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Para…
The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenti…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
05/09/2026
[CVE-2026-16649] The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Fi…
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
05/09/2026
[CVE-2026-77233] The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu…
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execu…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
05/09/2026
[CVE-2026-77263] The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu…
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesse…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2022-35499] In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site …
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
04/09/2026
Vulnerabilidad XSS alta en OpenPanel anterior a 2.3.0 permite ejecución de scripts remota
OpenPanel antes de la versión 2.3.0 contiene una vulnerabilidad de cross-site scripting (XSS) en el endpoint no autenticado GET /misc/favicon que permite a atacantes remotos ejecutar código malicioso mediante archivos SVG. Los atacantes pueden alojar archivos SVG con scripts embebidos que se ejecutan en el navegador de la víctima con el origen de la API, facilitando solicitudes autenticadas a endpoints protegidos. Esta vulnerabilidad afecta infraestructuras de hosting y control de paneles en servidores de empresas LATAM.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
04/09/2026
Vulnerabilidad XPS almacenado en Grav Shortcode Core anterior a 6.2.5
Grav Shortcode Core versiones anteriores a 6.2.5 contiene vulnerabilidades de cross-site scripting (XSS) almacenado en los parámetros de etiqueta [lorem] y resumen [details], que se renderizan sin validación. Atacantes con acceso de edición pueden inyectar código HTML y JavaScript arbitrario que se ejecuta en navegadores de visitantes, incluidos administradores. Afecta sitios Grav en producción que permiten edición de contenido a múltiples usuarios.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-84812] Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
03/09/2026
[CVE-2026-84848] Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.
Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-84773] Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-84763] Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.
Unauthenticated Cross Site Scripting (XSS) in RTMKit
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-84765] Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-81292] Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Simple Payment
nvdaltovulnerabilidad CVSS 7.1 NVD