Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-107657] The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnera…

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-96765] The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vul…

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user a…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-93951] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-96278] The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUES…

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass wor…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-100178] The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting…

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-101920] The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPres…

The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment (href attribute inside comment content)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-100147] The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored…

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user acc…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-95684] The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc…

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-96558] The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to S…

The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whene…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-96572] The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Si…

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-96840] The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scrip…

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPres…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-107742] The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is…

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a us…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-100196] The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to St…

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into the page HTML)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-100161] The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site …

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 39 min

[CVE-2026-96667] The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable t…

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 39 min

[CVE-2026-96682] The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Cont…

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 39 min

[CVE-2026-93775] The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via …

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection is trigger…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 39 min

[CVE-2026-87780] The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted…

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad Nuevo

Hace 39 min

[CVE-2026-14335] The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is …

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 9 horas

[CVE-2026-108260] Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/…

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's …

nvdaltovulnerabilidad CVSS 7.6 NVD