Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/10/2026

Inyección SQL alta en Smart Manager para WooCommerce afecta tiendas online

El plugin Smart Manager para WordPress es vulnerable a inyección SQL a través del parámetro 'access_privileges' en versiones hasta 8.97.0. Atacantes autenticados pueden ejecutar consultas maliciosas y comprometer datos de inventario, clientes y transacciones en tiendas de comercio electrónico. El riesgo es alto en plataformas multitienda comunes en México y Latinoamérica que usan este plugin para gestión masiva de productos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad Stored DOM XSS alta en plugin Visitor Traffic Real Time Statistics para WordPress

El plugin Visitor Traffic Real Time Statistics para WordPress es vulnerable a inyección de scripts almacenados a través del encabezado HTTP 'X-Real-IP' en todas las versiones hasta la 8.16. Atacantes no autenticados pueden inyectar código malicioso que se ejecuta cuando usuarios acceden a páginas comprometidas. Esta vulnerabilidad afecta directamente a sitios WordPress en LATAM que dependen de este plugin para analíticas de tráfico en tiempo real.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad XPS almacenado en plugin Strong Testimonials para WordPress (CVE-2026-96650)

El plugin Strong Testimonials versión 3.3.11 y anteriores contiene una vulnerabilidad de Cross-Site Scripting (XPS) almacenado en el campo personalizado 'platform_user_photo' debido a sanitización insuficiente. Atacantes no autenticados pueden inyectar código malicioso que se ejecutará cuando usuarios accedan a páginas comprometidas. Afecta principalmente a sitios WordPress en producción sin validación de entrada en campos de testimonios.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad alta en Simple Membership para WordPress permite modificación no autorizada de datos

El plugin Simple Membership para WordPress (versiones hasta 4.8.3) contiene una vulnerabilidad que permite a atacantes no autenticados modificar datos y acceder a información sensible a través de los endpoints resend-activation y email-activation. La falta de validación de autenticación, nonce y permisos en estas funciones expone a miles de sitios WordPress en LATAM que utilizan este plugin gratuito para gestionar membresías.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad de XSS almacenado en plugin SEOPress para WordPress afecta versiones hasta 10.2

El plugin SEOPress para WordPress es vulnerable a inyección de scripts maliciosos (XSS almacenado) a través del campo de nombre de autor, permitiendo a atacantes sin autenticación ejecutar código arbitrario en páginas afectadas. La vulnerabilidad impacta todos los sitios WordPress que utilicen versiones 10.2 o anteriores del plugin, especialmente aquellos con múltiples usuarios o perfiles públicos visibles.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad XMS almacenado alta en plugin Transliterator para WordPress

El plugin The Transliterator (versiones hasta 2.5.8) para WordPress presenta una vulnerabilidad de Cross-Site Scripting (XSS) almacenado que permite a atacantes no autenticados inyectar código malicioso a través de comentarios. La falla radica en insuficiente sanitización de entrada y escapado de salida en placeholders predecibles {rstr_keep}. Afecta directamente a sitios WordPress en LATAM con comentarios públicos habilitados, exponiendo datos de visitantes y administradores.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad XLS almacenado en GD Rating System para WordPress afecta sitios sin autenticación

El plugin GD Rating System (versiones ≤3.7.1) contiene un fallo de validación en los parámetros 'title' y 'url' del manejador AJAX gdrts_live_handler, permitiendo inyección de scripts maliciosos sin requerir autenticación. Los atacantes pueden ejecutar código arbitrario en el navegador de visitantes, comprometiendo sesiones administrativas, robando credenciales o redirigiendo tráfico. Afecta especialmente a sitios de e-commerce y plataformas de opiniones en LATAM.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-88783] The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed H…

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administr…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-89236] The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters befo…

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-87091] The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlem…

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The IPN endp…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-103913] The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitu…

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved, combined with the direct string interpolation of those values into a distance sub-expression in geodir_gps_q…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-101928] The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Script…

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is p…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-92977] The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored …

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Maliciou…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-97644] The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Pr…

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — includi…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-92536] The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict C…

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addres…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

03/10/2026

[CVE-2026-105080] In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes the…

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-104478] Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authe…

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

02/10/2026

[CVE-2026-84411] The web management service in affected RouterOS versions contains an integer underflow in its HTTP r…

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-94591] Armatura One stores database and message-broker credentials in an install configuration file, encryp…

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, a…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-94592] Armatura One's database initialization routine assigns a fixed, vendor-defined password to the datab…

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can authenticate as the database superuser on a deployment where it has not been changed.

nvdaltovulnerabilidad CVSS 8.4 NVD