Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/10/2026

[CVE-2026-101159] The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews s…

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-92977] The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored …

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Maliciou…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-96270] The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Mem…

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-93875] The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friend…

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

Vulnerabilidad SSRF alta en YesWiki anterior a 4.6.7 permite inyección de código

YesWiki versiones anteriores a 4.6.7 contiene una vulnerabilidad de falsificación de solicitud del lado del servidor (SSRF) en la acción Bazar valeur que permite a editores de páginas forzar al servidor a acceder URLs arbitrarias. Los atacantes pueden explotar esta falla para escanear servicios internos, acceder a metadatos de instancias en la nube (AWS/Azure) y ejecutar scripts maliciosos en navegadores de usuarios. El impacto es alta para wikis colaborativos en instituciones educativas y gubernamentales de LATAM.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104414] Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows atta…

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104411] Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows sta…

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104413] Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows sta…

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-87920] The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Con…

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Thi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-97663] The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripti…

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This require…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-97342] The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-…

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a use…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-97641] The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting v…

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploita…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-96566] The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cro…

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to, and including, 9.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-96567] The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' p…

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The CSRF gate protecting form su…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-96578] The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross…

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-96871] The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type'…

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable on any boa…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-97336] The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Typ…

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an integ…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-93756] The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulne…

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that wil…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-95670] The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL …

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-95817] The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comm…

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation delays but…

nvdaltovulnerabilidad CVSS 7.2 NVD