Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/08/2026

[CVE-2026-75796] The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized …

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-16576] The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 d…

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Man…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

21/08/2026

Vulnerabilidad XSS almacenado alta en WPForms Pro para WordPress

El complemento WPForms Pro para WordPress es vulnerable a inyección de scripts almacenados en campos de texto simple y párrafo (versiones hasta 2.0.0.2) debido a sanitización insuficiente. Atacantes no autenticados pueden inyectar código malicioso que se ejecuta cuando usuarios acceden a páginas comprometidas. Este riesgo es alta para sitios comerciales, de servicios y gobierno en LATAM que dependen de formularios para captura de datos.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

20/08/2026

Inyección SQL sin autenticación en BookingPress Appointment Booking Pro <= 6.0.2

Se ha identificado una vulnerabilidad crítica de inyección SQL sin autenticación en BookingPress Appointment Booking Pro versiones 6.0.2 y anteriores (CVSS 9.3). Esta falla permite a atacantes remotos ejecutar comandos SQL arbitrarios contra bases de datos de sitios WordPress que utilizan este plugin, comprometiendo datos de clientes, citas y información sensible. En LATAM, donde muchos pequeños negocios y empresas utilizan este plugin para agendamiento de servicios (salones, consultorios, servicios profesionales), la exposición es crítica.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

20/08/2026

Inyección SQL en WP w3all phpBB <= 3.0.5 afecta cuentas de suscriptores

Se ha identificado una vulnerabilidad de inyección SQL en WP w3all phpBB versiones 3.0.5 y anteriores que permite a usuarios suscritos ejecutar comandos SQL arbitrarios. Esta falla (CVSS 8.5) impacta directamente sitios WordPress que integran foros phpBB, afectando potencialmente bases de datos de clientes, transacciones y datos sensibles. En LATAM, donde muchos portales de e-commerce y comunidades online utilizan esta integración, la exposición es alta.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

20/08/2026

Autenticación rota en User Registration & Membership Pro <= 5.4.5 (CVE-2026-74001)

Se ha identificado una vulnerabilidad crítica de autenticación sin validación en User Registration & Membership Pro versión 5.4.5 y anteriores, permitiendo a atacantes acceder a funciones sensibles sin credenciales válidas. Afecta principalmente a sitios WordPress en México y LATAM que utilizan este plugin para gestión de usuarios. El CVSS de 9.8 indica riesgo severo para confidencialidad e integridad de datos de membresía.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-66592] Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-66594] Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.

Subscriber SQL Injection in WordPress Persistent Login

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-75963] The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up t…

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-75860] The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verifica…

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-15049] The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a …

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-18315] The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Auth…

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/08/2026

Vulnerabilidad XSS almacenado en plugin TranslatePress para WordPress hasta v3.2.5

El plugin TranslatePress para WordPress contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado sin autenticación requerida en versiones hasta 3.2.5. Los marcadores especiales '#!trpst#' y '#!trpen#' se reescriben incondicionalmente a caracteres HTML, permitiendo inyección de código malicioso. Afecta principalmente a sitios multilingües en LATAM que utilizan este plugin para traducción de contenidos.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

19/08/2026

Vulnerabilidad XSS en WP Statistics afecta sitios WordPress hasta versión 14.16.8

El plugin WP Statistics para WordPress contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el parámetro 'utm_campaign' que permite a atacantes no autenticados inyectar scripts maliciosos. La falla afecta todas las versiones hasta 14.16.8 y se ejecuta cuando visitantes acceden a páginas comprometidas, poniendo en riesgo datos de usuarios y credenciales en sitios empresariales, de comercio electrónico y portales informativos comunes en LATAM.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-19842] The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML respo…

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including a…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-19055] The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parame…

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-19056] The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter be…

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-18937] The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accep…

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-18776] The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of i…

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-18031] The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before est…

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.

nvdcriticovulnerabilidad CVSS 9.8 NVD