Media
CVE-2025-11454
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 41.670
Restablecer filtros
Alta
CVE-2025-11994
Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting
Media
CVE-2025-12732
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure
Alta
CVE-2025-12903
Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud
Alta
CVE-2025-12633
Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection
Media
CVE-2025-12018
MembershipWorks <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting
Media
CVE-2025-12113
Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion
Media
CVE-2025-12087
Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion
Media
CVE-2025-12901
Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update
Media
CVE-2025-64217
Photography <= 7.7.2 - Reflected Cross-Site Scripting
Alta
CVE-2025-12835
WooMulti <= 1.7 - Authenticated (Subscriber+) Arbitrary File Deletion
Media
CVE-2025-13000
DB Access <= 0.8.7 - Authenticated (Subscriber+) SQL Injection
Media
CVE-2025-66061
Seriously Simple Podcasting <= 3.13.0 - Cross-Site Request Forgery
Media
CVE-2025-12833
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
Media
CVE-2025-66099
Chat Help <= 3.1.3 - Missing Authorization
Media
CVE-2025-13001
Donation <= 1.0 - Authenticated (Admin+) SQL Injection
Media
CVE-2025-12788
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass
Media
CVE-2025-12953
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.2.0 - Missing Authorization to Authenticated (Subscriber+) Listing Types Tampering
Crítica
CVE-2025-12539
TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover
Media
CVE-2025-12787
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
Alta
CVE-2025-12846
Blocksy Companion <= 2.1.19 - Subida arbitraria de archivos autenticada mediante omisión de SVG (Autor+)
Una vulnerabilidad en el complemento Blocksy Companion para WordPress permite a atacantes autenticados con rol de autor o superior subir archivos arbitrarios al servidor, lo que puede posibilitar la ejecución remota de código.
Media
CVE-2025-12880
Progress Bar Blocks for Gutenberg <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
Media
CVE-2025-12652
Ungapped Widgets <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Media
CVE-2025-11129
Include fussball.de Widgets <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'api' and 'type'
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.