Archivo de vulnerabilidades

Conoce las vulnerabilidades. Protege tus aplicaciones.

Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.

Plataforma

Gravedad

Publicada desde

Publicada hasta

Archivo de vulnerabilidades 1.681

Restablecer filtros

Alta 10.07.2026

CVE-2026-57767

WP Google Maps Pro <= 10.1.02 - Cross-Site Scripting almacenado no autenticado

El plugin WP Google Maps Pro para WordPress es vulnerable a Cross-Site Scripting almacenado por falta de saneamiento y escape de datos, permitiendo a atacantes no autenticados inyectar scripts en páginas que se ejecutan al visitarlas.

Alta 09.07.2026

CVE-2026-13430

Post Export Import with Media <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import

Alta 09.07.2026

CVE-2026-12595

LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback

Alta 09.07.2026

CVE-2026-12598

LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback

Alta 09.07.2026

CVE-2026-13492

UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field

Alta 09.07.2026

CVE-2026-57738

777 <= 1.13.0 - Unauthenticated PHP Object Injection

Alta 09.07.2026

CVE-2026-59518

Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.8.2 - Authenticated (Subscriber+) PHP Object Injection

Alta 09.07.2026

CVE-2026-57710

WoowBot Pro Max <= 14.1.7 - Authenticated (Subscriber+) Arbitrary File Upload

Alta 09.07.2026

CVE-2026-57770

Grand Photography WordPress <= 5.7.8 - Unauthenticated PHP Object Injection

Media 08.07.2026

CVE-2026-9027

CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint

Media 08.07.2026

CVE-2026-12428

Blocks for ACF Fields <= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter

Alta 08.07.2026

CVE-2026-8848

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation

Crítica 08.07.2026

CVE-2026-14245

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter

Alta 08.07.2026

CVE-2026-5523

Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form

Alta 08.07.2026

CVE-2026-57713

Events Manager – Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection

Alta 07.07.2026

CVE-2026-14495

DoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token

Alta 07.07.2026

CVE-2026-57371

WPJAM Basic <= 7.0 - Authenticated (Contributor+) PHP Object Injection

Media 07.07.2026

CVE-2026-59521

Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials <= 3.1.15 - Authenticated (Administrator+) PHP Object Injection

Alta 06.07.2026

CVE-2026-57744

RT-Theme 18 Responsive WordPress Theme <= 2.5 - Unauthenticated PHP Object Injection

Alta 06.07.2026

CVE-2026-57724

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated PHP Object Injection

Crítica 03.07.2026

CVE-2026-12497

ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation

Media 02.07.2026

CVE-2026-8489

Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field

Media 02.07.2026

CVE-2026-9180

MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter

Media 01.07.2026

CVE-2026-9145

Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación

Conoce las vulnerabilidades. Protege tus aplicaciones.

Archivo de vulnerabilidades 1.681

Identifica las vulnerabilidades de tu aplicación

La seguridad de tus aplicaciones en tu correo