Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 6 días

Vulnerabilidad de omisión de autorización en plugin Nelio Content para WordPress (CVE-2026-94505)

El plugin Nelio Content – Editorial Calendar & Social Media Auto-Posting para WordPress es vulnerable a omisión de autorización en versiones hasta 4.5.0. Atacantes autenticados con acceso de contribuidor pueden eliminar permanentemente contenido de redes sociales reutilizables. Afecta especialmente a agencias de marketing digital y empresas de comunicación en LATAM que usan WordPress con este plugin.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 6 días

Vulnerabilidad alta en Simple Membership para WordPress permite modificación no autorizada de datos

El plugin Simple Membership para WordPress (versiones hasta 4.8.3) contiene una vulnerabilidad que permite a atacantes no autenticados modificar datos y acceder a información sensible a través de los endpoints resend-activation y email-activation. La falta de validación de autenticación, nonce y permisos en estas funciones expone a miles de sitios WordPress en LATAM que utilizan este plugin gratuito para gestionar membresías.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-88783] The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed H…

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administr…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-91078] The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the…

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

02/10/2026

[CVE-2026-95102] WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate chargin…

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-82039] UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBu…

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.format(). Attackers can exploit the GET /api/utm-asset-groups/searchGroupsByFilter endpoint to execute arb…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-51916] TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_use…

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowledge object without requiring authentication in the route and without verifying organization ownership of the supplied knowledge_id.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

Vulnerabilidad alta de bypass de autenticación en YesWiki anteriores a 4.6.7

YesWiki antes de la versión 4.6.7 contiene una vulnerabilidad de bypass de autenticación en la bandeja de entrada ActivityPub que no vincula correctamente la firma HTTP verificada con el actor de la actividad. Atacantes no autenticados pueden utilizar cualquier par de claves ActivityPub para enviar actividades Delete o Update firmadas, permitiendo eliminar o sobrescribir entradas federadas de otros actores, especialmente en sistemas colaborativos y wikis corporativas.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104431] Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to s…

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() before standardness checks, saturating the verifier buffer and rendering the node unresp…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

02/10/2026

[CVE-2026-94541] The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization b…

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-97663] The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripti…

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This require…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-97342] The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-…

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a use…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

02/10/2026

[CVE-2026-97637] The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Coo…

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed solely by URI and query string, ignoring HTTP method and POST body; this causes the `generate_auth_cookie()…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-93756] The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulne…

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that wil…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-103426] The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_r…

The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the click-tra…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-100107] The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the …

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-90438] The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to…

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a u…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-91828] The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not …

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-15897] The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalatio…

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action='update' flow, trusting an attacker-supplied user_id value and passing it to wp_update_user() without any ownership or capability check. Bec…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

02/10/2026

[CVE-2026-15896] The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal…

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no au…

nvdcriticovulnerabilidad CVSS 9.1 NVD