Saltar al contenido

Radar en marcha

Bastion/Radar

[■] Gestor de contenidos

WordPress

Web oficial

43.917 expedientes en el radar

Comprueba tu versión de WordPress Sólo las que se están explotando

[■] Para hacerlo bien

Guías

[■] Registro

Vulnerabilidades (43.917)

  1. 4,3 Media

    CVE-2026-118202: autenticación incorrecta en Limit Login Attempts Security

    CVE-2026-118202

    T−8d 6 nov. 2026

  2. 4,9 Media

    CVE-2026-104639: inyección SQL en Razorpay for WooCommerce

    CVE-2026-104639

    T−8d 6 nov. 2026

  3. 4,9 Media

    CVE-2026-118056: cross-site scripting (XSS) en Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )

    CVE-2026-118056

    T−8d 6 nov. 2026

  4. 5,3 Media

    CVE-2026-81422: falta de autorización en Advanced Appointment Booking & Scheduling

    CVE-2026-81422

    T−8d 6 nov. 2026

  5. 7,2 Alta

    CVE-2026-93429: cross-site scripting (XSS) en VikBooking Hotel Booking Engine & PMS

    CVE-2026-93429

    T−8d 6 nov. 2026

  6. 5,4 Media

    CVE-2026-120035: cross-site scripting (XSS) en RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

    CVE-2026-120035

    T−8d 5 nov. 2026

  7. 6,5 Media

    CVE-2026-89101: acceso a datos de otros usuarios (IDOR) en Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

    CVE-2026-89101

    T−8d 5 nov. 2026

  8. 9,1 Crít.

    CVE-2026-114630: recorrido de rutas (path traversal) en ELEX WordPress HelpDesk & Customer Ticketing System

    CVE-2026-114630

    T−8d 5 nov. 2026

  9. 7,5 Alta

    CVE-2026-104010: deserialización de datos no fiables en WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database

    CVE-2026-104010

    T−8d 5 nov. 2026

  10. 6,4 Media

    CVE-2026-116551: cross-site scripting (XSS) en WP Customer Area

    CVE-2026-116551

    T−8d 5 nov. 2026

  11. 5,4 Media

    CVE-2026-119178: cross-site scripting (XSS) en Smart Cookie Kit

    CVE-2026-119178

    T−8d 5 nov. 2026

  12. 8,1 Alta

    CVE-2026-92895: subida de ficheros peligrosos en Live2DWebCanvas

    CVE-2026-92895

    T−8d 5 nov. 2026

  13. 7,6 Alta

    CVE-2026-103479: gestión incorrecta de privilegios en Pubjet | پاب‌جت

    CVE-2026-103479

    T−8d 5 nov. 2026

  14. 9,8 Crít.

    CVE-2026-107622: gestión incorrecta de privilegios en BuddyForms

    CVE-2026-107622

    T−8d 5 nov. 2026

  15. 6,4 Media

    CVE-2026-116545: cross-site scripting (XSS) en All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos

    CVE-2026-116545

    T−8d 5 nov. 2026

  16. 5,4 Media

    CVE-2026-107658: cross-site scripting (XSS) en BuddyForms

    CVE-2026-107658

    T−8d 5 nov. 2026

  17. 8,8 Alta

    CVE-2026-116624: gestión incorrecta de privilegios en Advanced Members for ACF

    CVE-2026-116624

    T−8d 5 nov. 2026

  18. 4,9 Media

    CVE-2026-119211: cross-site scripting (XSS) en AAA Autoload Optimizer

    CVE-2026-119211

    T−8d 5 nov. 2026

  19. 5,4 Media

    CVE-2026-103908: inyección de código en AMP for WP – Accelerated Mobile Pages

    CVE-2026-103908

    T−8d 5 nov. 2026

  20. 4,9 Media

    CVE-2026-109977: inyección SQL en YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports

    CVE-2026-109977

    T−8d 5 nov. 2026

  21. 6,4 Media

    CVE-2026-120550: cross-site scripting (XSS) en WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory

    CVE-2026-120550

    T−8d 5 nov. 2026

  22. 5,3 Media

    CVE-2026-120659: falta de autorización en Redirection for Contact Form 7

    CVE-2026-120659

    T−8d 5 nov. 2026

  23. 7,2 Alta

    CVE-2026-110776: cross-site scripting (XSS) en MDTF – Meta Data and Taxonomies Filter

    CVE-2026-110776

    T−8d 5 nov. 2026

  24. 6,5 Media

    CVE-2026-109994: falta de autorización en Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce

    CVE-2026-109994

    T−8d 5 nov. 2026

  25. 6,4 Media

    CVE-2026-97642: cross-site scripting (XSS) en Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت

    CVE-2026-97642

    T−8d 5 nov. 2026

  26. 4,3 Media

    CVE-2026-115831: falta de autorización en VOD Infomaniak

    CVE-2026-115831

    T−8d 5 nov. 2026

  27. 6,4 Media

    CVE-2026-120671: cross-site scripting (XSS) en UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

    CVE-2026-120671

    T−8d 5 nov. 2026

  28. 6,5 Media

    CVE-2026-121794: falta de autorización en Travelly – Tour & Travel Booking Manager for WooCommerce

    CVE-2026-121794

    T−8d 5 nov. 2026

  29. 6,4 Media

    CVE-2026-122222: cross-site scripting (XSS) en Permalink Manager Lite

    CVE-2026-122222

    T−8d 5 nov. 2026

  30. 7,2 Alta

    CVE-2026-110291: cross-site scripting (XSS) en Graphina – Charts and Graphs For Elementor

    CVE-2026-110291

    T−8d 5 nov. 2026