Alertas de Seguridad de la Información

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-18051] The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it use…

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can stri…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-17565] The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied …

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16616] The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-mov…

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16617] The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's …

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16950] The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a paramet…

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-14861] The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request …

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16570] The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of t…

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-14334] The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly s…

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-13174] The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting …

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-12983] The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in…

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticated visitor to wipe the Dinatur WordPress plugin through 1.18's data.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-13169] The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allo…

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-11565] The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in seve…

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configuration files — and to overwrite existing non-PHP files, which can be leveraged to …

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

19/08/2026

Vulnerabilidad alta en plugin Atarim para WordPress permite eliminación arbitraria de archivos

El plugin Atarim para WordPress (versiones hasta 5.1.1) contiene una falla de validación de rutas de archivo que permite a atacantes autenticados con nivel de autor eliminar archivos arbitrarios del servidor. Afecta principalmente a agencias digitales y estudios de diseño en LATAM que utilizan este plugin para gestión de contenido y feedback de clientes. La vulnerabilidad requiere acceso autenticado pero representa riesgo alta en entornos multiusuario.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-66602] Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar all…

Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-73351] Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-75091] The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnera…

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-15748] The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up …

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler th…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-11801] The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all…

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including register…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-65640] WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file uploa…

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

16/08/2026

Vulnerabilidad crítica de inyección de objetos PHP en plugin ARForms para WordPress

El plugin ARForms (Contact Form, Survey, Quiz & Popup Form Builder) para WordPress contiene una vulnerabilidad de inyección de objetos PHP (CVE-2024-13784, CVSS 9.8) en versiones hasta 1.8.5 que permite a atacantes no autenticados inyectar objetos maliciosos mediante deserialización de datos en envíos de formularios. Aunque actualmente no hay cadenas POP conocidas explotadas, esta vulnerabilidad expone sitios web en México y Latinoamérica que utilicen este plugin, afectando formularios de contacto, encuestas y popups que interactúan directamente con usuarios.

nvdcriticovulnerabilidad CVSS 9.8 NVD