Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,599
Total alertas
3086
Críticas
10241
Altas
8
Ransomware
1807
Esta semana
RSS
cwe-79 × 30 días × Limpiar todo ×
M Alto vulnerabilidad
06/08/2026
[CVE-2026-65545] Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
Unauthenticated Cross Site Scripting (XSS) in AI Engine
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-65509] Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.
Unauthenticated Cross Site Scripting (XSS) in wpDataTables
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-65513] Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-65515] Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-65517] Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-61963] Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-61964] Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
06/08/2026
[CVE-2026-61982] Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-61961] Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
Unauthenticated Cross Site Scripting (XSS) in EmbedPress
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-28177] Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Popup Maker
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-28141] Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-28143] Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Forminator
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-28082] Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.
Unauthenticated Cross Site Scripting (XSS) in JetEngine
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
06/08/2026
Vulnerabilidad XSS Almacenado alta en FormGent para WordPress (CVE-2025-15028)
El plugin FormGent para WordPress es vulnerable a inyección de scripts almacenados (XSS) en campos de formularios hasta la versión 1.9.2 debido a sanitización insuficiente. Atacantes no autenticados pueden inyectar código malicioso que se ejecuta en navegadores de visitantes, comprometiendo datos de formularios y credenciales de clientes. Afecta directamente a pymes y emprendimientos en LATAM que utilizan este plugin para captura de leads, pagos y encuestas.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
06/08/2026
Vulnerabilidad XSS almacenado alta en plugin TranslatePress para WordPress (CVE-2026-18510)
El plugin TranslatePress de WordPress presenta una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en versiones hasta 3.2.6 que permite a atacantes sin autenticación inyectar código malicioso a través de comentarios con marcadores gettext codificados. La falta de sanitización de entrada y escapado de salida afecta directamente a sitios web multilingües en México y LATAM que dependen de este plugin para traducción de contenidos, comprometiendo la integridad y seguridad de visitantes y datos.
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
06/08/2026
[CVE-2026-18325] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vuln…
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whe…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-16636] The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Pr…
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
05/08/2026
[CVE-2026-9195] A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6…
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
05/08/2026
[CVE-2026-17506] The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the …
The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and including, 2.15.0. This is due to the get_cell_content() function applying urldecode() after esc_url() when rendering the URL column for 404 entries — a sequence that allows percent-encoded HTML to pass URL validation and then be reconstruc…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
05/08/2026
[CVE-2026-71285] Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-…
Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo `siteId` value as a bare, unquoted JavaScript expression inside a block rendered on every public status page: `_paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);`. The escaping pipeline used (jsesc with isScriptContext:true, then html-escaper.escape()) does not esc…
nvdaltovulnerabilidad CVSS 8.1 NVD