Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/08/2026

[CVE-2026-15414] The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in vers…

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles — the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'ad…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-15258] The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise a…

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-16236] The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up …

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for auth…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-14930] The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or owners…

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-15048] The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its A…

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-14830] The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout …

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-14919] The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting tes…

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-12721] The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from t…

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-13392] The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget d…

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-supe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-13609] The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted…

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9'…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-14319] The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint …

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-14333] The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessibl…

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-14483] The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary Fi…

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installation…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-12251] The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities…

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-12695] The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password …

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-12720] The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when i…

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress v…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-15397] The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all…

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_plugin_configuration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install a…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-15240] The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching…

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-14602] The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing use…

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remote API WordPress plugin through 0.2.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-13178] The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts a…

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.

nvdaltovulnerabilidad CVSS 7.5 NVD