Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/09/2026

[CVE-2026-85130] The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a p…

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-87796] The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in …

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution poss…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-87935] The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to…

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

Inyección SQL en WP Mega Menu permite acceso no autorizado a bases de datos

Se ha identificado una vulnerabilidad de inyección SQL ciega (CVSS 7.6) en el complemento WP Mega Menu para WordPress, versiones hasta 1.4.2. Empresas que utilizan este plugin en sitios de comercio electrónico, portales corporativos y aplicaciones con datos sensibles en México y LATAM están expuestas a extracción no autorizada de información de bases de datos. Un atacante remoto puede ejecutar comandos SQL maliciosos sin autenticación.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89063] The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to …

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-78088] The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is…

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite known files wh…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-18595] The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJ…

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-14349] The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to auth…

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-12793] The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Esc…

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for un…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90650] The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th…

The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The pr…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-14805] The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and incl…

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in adm…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-75983] The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is v…

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-89023] ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vuln…

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, m…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-85129] The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one…

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-88793] The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one…

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an adminis…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-88802] The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress pl…

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-74933] The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of …

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

13/09/2026

[CVE-2026-81648] The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check…

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-86406] The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of t…

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged ro…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-89080] The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated reques…

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

nvdaltovulnerabilidad CVSS 7.5 NVD