Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19794] The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to…

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-18039] The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied reg…

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-15205] The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplie…

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user c…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-12949] The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verifica…

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-18109] The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Aut…

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only expl…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-28154] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-15413] The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it …

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-18146] The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin fo…

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-18945] The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its…

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders. Exploitation requires WooCommerce to be active and the WP Helper Premium…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-14182] The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly val…

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-18789] The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content ex…

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-18474] The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before u…

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-18391] The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unse…

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-18230] The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before u…

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-18366] The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, di…

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-18049] The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce …

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-18057] The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled val…

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-18048] The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled val…

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-16977] The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-contr…

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16538] The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collec…

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.

nvdcriticovulnerabilidad CVSS 9.1 NVD