Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 3 horas

[CVE-2026-96558] The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to S…

The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whene…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 3 horas

[CVE-2026-96572] The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Si…

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 3 horas

[CVE-2026-96840] The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scrip…

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPres…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 3 horas

[CVE-2026-107742] The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is…

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a us…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 3 horas

[CVE-2026-100196] The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to St…

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into the page HTML)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 3 horas

[CVE-2026-100161] The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site …

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-96667] The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable t…

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-96682] The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Cont…

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-93775] The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via …

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection is trigger…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-94256] The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the…

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-94257] The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being chang…

The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-87780] The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted…

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-87781] The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter befo…

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-14335] The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is …

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-104752] The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file up…

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-104723] The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable t…

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vuln…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad Nuevo

Hace 5 horas

[CVE-2026-103889] The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execut…

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template w…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad Nuevo

Hace 5 horas

[CVE-2026-104021] The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to,…

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the `fastcache_settings[cache_cookie_exclude][]` parameter. This is due to the plugin registering the `cache_cookie_exclude` setting via `register_setting()` without a `sanitize_callback`, while `buildSiteHtaccessRules()` applies only `trim()` to each cookie value before in…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad Nuevo

Hace 6 horas

[CVE-2026-107645] The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, …

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_cu…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad Nuevo

Hace 13 horas

[CVE-2026-92705] Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loa…

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS`  file execute…

nvdaltovulnerabilidad CVSS 7.8 NVD