Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-96667] The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable t…

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-96682] The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Cont…

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-93775] The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via …

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection is trigger…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-14335] The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is …

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 8 horas

[CVE-2026-108260] Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/…

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad Nuevo

Hace 9 horas

[CVE-2026-107845] Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor…

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under th…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad Nuevo

Hace 12 horas

[CVE-2026-108159] AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-…

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, execu…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 15 horas

[CVE-2026-94066] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 15 horas

[CVE-2026-94063] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 16 horas

[CVE-2026-94061] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflected XSS.This issue affects Whistle - Sports Club: from n/a through 4.2.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 16 horas

[CVE-2026-94058] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 16 horas

[CVE-2026-94059] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Ogency: from n/a through 1.0.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 16 horas

[CVE-2026-94060] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue affects Voldor: from n/a through 1.0.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 16 horas

[CVE-2026-105318] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 16 horas

[CVE-2026-105870] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 19 horas

Vulnerabilidad XSS en FiboSearch para WooCommerce permite inyección de código malicioso

Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en el plugin FiboSearch (ajax-search-for-woocommerce) versión 1.34.1 y anteriores, utilizado en tiendas en línea basadas en WordPress. Un atacante podría inyectar código JavaScript malicioso a través de parámetros de búsqueda, comprometiendo sesiones de clientes y administradores en México y Latinoamérica. Esta vulnerabilidad afecta directamente a comercios electrónicos que dependen de este plugin para funcionalidad de búsqueda.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 19 horas

Vulnerabilidad XSS alta en Basix NEX-Forms afecta formularios WordPress

Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en Basix NEX-Forms versión 9.3.1 y anteriores, que permite inyectar código malicioso a través de formularios en WordPress. Esta falla afecta principalmente a sitios web en LATAM que utilizan este complemento popular para captura de datos y formularios de contacto. Un atacante podría comprometer sesiones de usuarios administrativos y robar información sensible de visitantes.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 19 horas

Vulnerabilidad XSS Reflejado en Welcart e-Commerce permite inyección de código en navegadores

Welcart e-Commerce (versiones hasta 2.12.3) contiene una falla de neutralización de entrada que permite ataques XSS reflejados. Un atacante puede inyectar código malicioso que se ejecuta en el navegador de clientes al acceder a URLs manipuladas. Esto afecta principalmente a tiendas en línea en México y Latinoamérica que usan esta plataforma, exponiendo datos de sesión y credenciales de usuarios.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 19 horas

Vulnerabilidad XSS Reflejado alta en Simple Payment (yalla ya!) – CVE-2026-96332

Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en el plugin Simple Payment versión 2.5.4 y anteriores, utilizado en plataformas de pago en línea. Esta falla permite a atacantes inyectar código malicioso a través de parámetros no sanitizados en la generación de páginas web. En LATAM, afecta a comercios electrónicos y plataformas de pagos que integren este componente, poniendo en riesgo datos sensibles de clientes y sesiones autenticadas.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 19 horas

Vulnerabilidad XSS Reflejado en HUSKY woocommerce-products-filter afecta tiendas en línea

Se identificó una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en el plugin HUSKY woocommerce-products-filter (versiones hasta 1.4.3.2) debido a neutralización impropia de entrada durante la generación de páginas web. Esta falla permite a atacantes inyectar código malicioso que se ejecuta en el navegador de clientes de tiendas WooCommerce, comprometiendo datos sensibles y sesiones de usuarios. Afecta directamente a comercios electrónicos en México y Latinoamérica que utilizan este plugin para filtrar productos.

nvdaltovulnerabilidad CVSS 7.1 NVD