Conoce las vulnerabilidades. Protege tus aplicaciones.

Media 09.10.2026

CVE-2026-96563

Motors <= 1.4.123 - Cross-Site Scripting almacenado autenticado (suscriptor+) mediante el parámetro 'stm_f_s'

El plugin Motors para WordPress es vulnerable a Cross-Site Scripting almacenado mediante el parámetro stm_f_s. Atacantes autenticados con rol de suscriptor o superior pueden inyectar scripts web arbitrarios que se ejecutan cuando un usuario visita las páginas afectadas.

WordPress

motors-car-dealership-classified-listings

Media 04.09.2026

CVE-2026-76573

Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute

WordPress

pods

Media 04.09.2026

CVE-2026-74853

Pods – Custom Content Types and Fields 3.3 - 3.3.9.1 - Authenticated (Author+) Arbitrary File Read

WordPress

pods

Alta 28.08.2026

CVE-2026-74851

Pods – Custom Content Types and Fields < 3.3.9.1 - Authenticated (Author+) Remote Code Execution

WordPress

pods

Crítica 15.08.2026

CVE-2026-19598

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router

WordPress

pods

Media 31.07.2026

CVE-2026-17580

Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints

WordPress

acf-views

Media 22.07.2026

CVE-2026-59543

Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… <= 3.8.11 - Authenticated (Subscriber+) Remote Code Execution

WordPress

acf-views

Alta 15.06.2026

CVE-2026-54191

Pods – Custom Content Types and Fields <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting

WordPress

pods

Media 17.02.2026

CVE-2026-39658

Panda Pods Repeater Field <= 1.5.12 - Missing Authorization

WordPress

panda-pods-repeater-field

Media 02.03.2025

CVE-2025-1446

Pods – Custom Content Types and Fields <= 3.2.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting

WordPress

pods

Media 16.12.2024

CVE-2024-11849

Pods – Custom Content Types and Fields <= 3.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting

WordPress

pods

Media 15.10.2024

CVE-2024-9883

Pods <= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

WordPress

pods

Media 09.05.2024

CVE-2024-3956

Pods – Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL

WordPress

pods

Alta 28.03.2024

CVE-2023-6999

Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution

WordPress

pods

Media 28.03.2024

CVE-2023-6965

Pods - Custom Content Types and Fields - Missing Authorization

WordPress

pods

Alta 28.03.2024

CVE-2023-6967

Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode

WordPress

pods

Alta 20.01.2023

CVE-2023-23790

Pods <= 2.9.10.2 - Cross-Site Request Forgery

WordPress

pods

Media 07.12.2022

CVE-2022-4306

Panda Pods Repeater Field <= 1.5.3 - Reflected Cross-Site Scripting

WordPress

panda-pods-repeater-field

Media 26.05.2022

0a49d74a-01a6-4bd9-bc93-0006f9fe9503

BuddyForms Hook Fields <= 1.3.8 - Cross-Site Scripting

WordPress

buddyforms-hook-fields

Media 06.08.2021

76d850dd-75f3-4671-9561-0e361d09a121

Pods – Custom Content Types and Fields <= 2.7.28 - Authenticated (Admin+) Cross-Site Scripting

WordPress

pods

Media 15.01.2021

CVE-2021-24339

Pods <= 2.7.26 - Authenticated Stored Cross-Site Scripting via Menu Label field

WordPress

pods

Media 15.01.2021

CVE-2021-24338

Pods 2.4.4.1 - 2.7.26 - Authenticated Stored Cross-Site Scripting

WordPress

pods

Crítica 16.03.2015

e95b2bfe-8675-4932-9b37-73ad15fa228e

Pods – Custom Content Types and Fields < 2.5.1.2 - SQL Injection

WordPress

pods

Crítica 12.01.2015

CVE-2014-7957

Pods <= 2.4.3 - Multiple Cross-Site Request Forgery

WordPress

pods