Alertas de Seguridad de la Información

M Alto vulnerabilidad

09/07/2026

[CVE-2026-9253] The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Sto…

The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter in all versions up to, and including, 10.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesse…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-4275] The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to …

The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress's built-in REST API nonce verification. Although the endpoint callbac…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-13441] The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored …

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts i…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-14372] The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugi…

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the serve…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-8848] The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder p…

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.22.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with editor-level access and above, to install …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15000] The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scr…

The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up to, and including, 0.9.78.06 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pag…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-11571] The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files genera…

The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-5523] The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to,…

The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the update_user() function accepting a user ID parameter from form submissions without verifying that the authenticated user has permission to edit that specific user account, and the handle_register_submission() function only checking if any user is logged in r…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-6820] The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc…

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-5356] The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerab…

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0. This is due to the plugin's Stripe Connect payment processor accepting a client-supplied PaymentIntent ID. This makes it possible for unauthenticated attackers to pay an arbitrary amount by supplying a previously succeeded …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-6818] The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc…

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-6854] The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQ…

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into alr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-3688] The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vu…

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.10. This is due to the 'wcfmvm_membership_change' AJAX action not validating user permission to modify other users. This makes it possible for authenticated attackers, with vendor level access and above, to chang…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-6230] The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery'…

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-12378] The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does …

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-9700] The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter …

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-14489] The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file ty…

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect() function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-14495] The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Ra…

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because `dologin\s::rrand()` seeds the Mersenne Twister with `mt_srand((double) microtime() * 1000000)` — discarding the integer-seconds component of `microtime()` and constraining the seed to a range of approximately 10^6 …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-9842] The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in…

The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the `manage_options` capability to the `backstage_customizer_user` demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyon…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-14158] The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions …

The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.52 via the widget_logic_visual_check_visibility function. This is due to missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action combined with insufficient sanitization of the 'nwlv[cod-tag]' parameter before storage and subsequ…

nvdaltovulnerabilidad CVSS 8.8 NVD