Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/08/2026

[CVE-2026-15372] The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when on…

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16036] The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured d…

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled destination, complete the challenge, and take over the account, including administrator accounts.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16055] The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the s…

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Gallery WordPress plugin before 30.0.7 and enables unlimited, unthrottled password guessing against any ac…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16561] The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in on…

The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16573] The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before sto…

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16602] The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning po…

The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-14553] The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the c…

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-15210] The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the …

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-8761] The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and incl…

The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the `CustomersController` REST controller (`includes/REST/CustomersController.php`), which re-registers WooCommerce's customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce's native `manage_woocommerce` c…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-9273] The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vuln…

The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-18322] The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versi…

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the `havePermissions()` function in `classes/frame.php`, where `array_merge()` overwrites the popup module's administrator-restricted method list with the base controller's value, silently removing `save` from protected a…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-15918] VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injec…

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arb…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16143] The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cr…

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the saveorder() function, which stores the raw email value via VikRequest::getString() (applying only sanitize_t…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-16618] The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking …

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-16623] The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before…

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-15958] The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization check…

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-16572] The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie …

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-16300] The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, all…

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-16532] The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied…

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-16534] The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's…

The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.

nvdcriticovulnerabilidad CVSS 9.1 NVD