Alertas de Seguridad de la Información

M Alto vulnerabilidad

22/09/2026

Inyección SQL ciega en HashBar WordPress Notification Bar (CVE-2026-94117)

Se detectó una vulnerabilidad alta de inyección SQL en el plugin HashBar para WordPress (versiones hasta 2.0.3) que permite a atacantes ejecutar consultas SQL no autorizadas contra bases de datos de sitios web. Esta vulnerabilidad afecta especialmente a pequeñas y medianas empresas en LATAM que utilizan WordPress con plugins de barras de notificación para campañas de marketing. Un atacante podría extraer datos sensibles, modificar registros o acceder a credenciales de administrador sin requiere autenticación previa.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

22/09/2026

Vulnerabilidad alta de inclusión de archivos en WP Travel Engine hasta v6.8.0

El plugin WP Travel Engine para WordPress es vulnerable a Local File Inclusion (LFI) en versiones anteriores a 6.8.0, permitiendo a atacantes autenticados con acceso de colaborador ejecutar archivos PHP arbitrarios en el servidor. Esta vulnerabilidad afecta directamente a agencias de viajes y operadores turísticos en LATAM que utilizan WordPress para gestionar reservas y consultas de tours, comprometiendo la integridad del servidor y datos de clientes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

Vulnerabilidad XSS almacenado alta en plugin WP Yelp Review Slider (CVE-2026-93778)

El plugin WP Yelp Review Slider para WordPress en versiones hasta 9.2 presenta una vulnerabilidad de Cross-Site Scripting (XSS) almacenado que permite a atacantes no autenticados inyectar scripts maliciosos a través del texto de reseñas de Yelp importadas. La falta de sanitización de entrada y escapado de salida permite que estos scripts se ejecuten cuando usuarios acceden a páginas comprometidas, afectando potencialmente datos sensibles y sesiones de administradores en sitios WordPress de empresas en LATAM.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

22/09/2026

Vulnerabilidad XSS almacenado en WPC Product Bundles for WooCommerce (CVE-2026-93836)

El plugin WPC Product Bundles para WooCommerce contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el parámetro 'qty' en versiones hasta 8.6.6, permitiendo a atacantes no autenticados inyectar código malicioso que se ejecuta cuando usuarios acceden a páginas comprometidas. Afecta tiendas en línea y plataformas de comercio electrónico en LATAM que utilizan WooCommerce. CVSS 7.2 (alto).

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

22/09/2026

Vulnerabilidad alta en plugin WP Ultimate Review permite ejecución arbitraria de shortcodes

El plugin WP Ultimate Review para WordPress (versiones hasta 2.4.2) es vulnerable a ejecución arbitraria de shortcodes debido a validación insuficiente en acciones de usuario. Atacantes autenticados con acceso de suscriptor pueden ejecutar código arbitrario, comprometiendo sitios WordPress comúnmente usados en LATAM para ecommerce, contenido corporativo y aplicaciones altas.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

Vulnerabilidad alta de inclusión de archivos en plugin HUSKY Products Filter para WooCommerce

El plugin HUSKY – Products Filter for WooCommerce Professional para WordPress (versiones hasta 1.4.4) contiene una vulnerabilidad de Local File Inclusion (LFI) que permite a atacantes no autenticados ejecutar código PHP arbitrario en servidores. Esta falla afecta directamente a tiendas en línea de LATAM que usan este plugin, exponiendo bases de datos, credenciales y datos de clientes. Con CVSS 8.1, es considerada alta y requiere acción inmediata.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-6922] The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Aut…

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2025-1281] The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insuffic…

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-91827] The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being…

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-92438] The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputtin…

The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-94504] Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encod…

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-89412] The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulner…

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-12470] The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unau…

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrar…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-19658] The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, …

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-13355] The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in vers…

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/09/2026

[CVE-2026-82187] The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extens…

The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-92540] The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce t…

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-92541] The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote…

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-82842] The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for …

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administ…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-85017] The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability ch…

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable ac…

nvdaltovulnerabilidad CVSS 7.5 NVD