Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/09/2026

Inyección de objetos PHP sin autenticación en Ninja Forms - Layout & Styles ≤ 3.0.31

Se ha identificado una vulnerabilidad alta de inyección de objetos PHP sin autenticación en el plugin Ninja Forms - Layout & Styles en versiones 3.0.31 y anteriores. Los atacantes pueden explotar esta falla para ejecutar código malicioso en servidores web, afectando principalmente a sitios WordPress en México y LATAM que utilizan este complemento. La vulnerabilidad tiene un score CVSS de 8.8, indicando riesgo alta de comprometimiento de integridad y disponibilidad.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

Exposición de datos sensibles sin autenticación en WooCommerce Product Attachment ≤ 2.3.3

WooCommerce Product Attachment versión 2.3.3 y anteriores contiene una vulnerabilidad que permite a atacantes acceder a datos sensibles sin requerir autenticación, con puntuación CVSS 7.5. Esta exposición afecta principalmente a tiendas en línea operadas en México y Latinoamérica que utilizan este plugin en WordPress. El riesgo se amplifica en entornos de comercio electrónico que manejan información de clientes, productos o transacciones.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/09/2026

Vulnerabilidad XSS sin autenticación en Estatik versiones ≤4.3.4 (CVSS 7.1)

Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) sin autenticación en Estatik versiones 4.3.4 y anteriores, que permite a atacantes inyectar código malicioso en aplicaciones web expuestas. Esta vulnerabilidad afecta principalmente a organizaciones en LATAM que utilizan este generador de sitios estáticos en entornos de producción sin restricciones de acceso. El riesgo es elevado si la aplicación procesa entrada de usuarios o está accesible desde internet.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-81288] Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versi…

Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-81289] Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar …

Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-19219] In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog …

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-18672] In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied s…

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-75528] The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Commen…

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation req…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-82883] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-81737] The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by u…

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute in the context of a logged in administrator.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-81807] The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before r…

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-78657] The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletio…

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-80467] The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role subm…

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-19723] The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properl…

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPr…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-14357] The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and in…

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary t…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-19116] The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from b…

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead to remote code execution when a suitable gadget chain is present on the site.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-12526] The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the reques…

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing ad…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-12865] The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters be…

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScrip…

nvdaltovulnerabilidad CVSS 7.1 NVD

? Medio alerta

02/09/2026

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA emite alerta de seguridad: CISA Adds Seven Known Exploited Vulnerabilities to Catalog. CVEs relacionados: CVE-2026-9586, CVE-2026-48710, CVE-2026-49869, CVE-2026-59822, CVE-2026-82329.

cisaus-certalerta CISA KEV

M Alto vulnerabilidad

02/09/2026

[CVE-2024-35585] Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.

nvdaltovulnerabilidad CVSS 8.6 NVD