Saltar al contenido

Radar en marcha

Bastion/Radar

[■] Gestor de contenidos

WordPress

Web oficial

43.917 expedientes en el radar

Comprueba tu versión de WordPress Sólo las que se están explotando

[■] Para hacerlo bien

Guías

[■] Registro

Vulnerabilidades (43.917)

  1. 5,3 Media

    CVE-2026-109367: exposición de información sensible en All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)

    CVE-2026-109367

    T−15d 30 oct. 2026

  2. 5,3 Media

    CVE-2026-103915: exposición de información sensible en Booking for Appointments and Events Calendar – Amelia

    CVE-2026-103915

    T−15d 30 oct. 2026

  3. 9,8 Crít.

    CVE-2026-118235: subida de ficheros peligrosos en SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications

    CVE-2026-118235

    T−15d 30 oct. 2026

  4. 6,4 Media

    CVE-2026-119160: cross-site scripting (XSS) en Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News

    CVE-2026-119160

    T−15d 30 oct. 2026

  5. 5,3 Media

    CVE-2026-101325: inyección SQL en Newsletters

    CVE-2026-101325

    T−15d 30 oct. 2026

  6. 7,2 Alta

    CVE-2026-110530: cross-site scripting (XSS) en FeedWordPress

    CVE-2026-110530

    T−15d 30 oct. 2026

  7. 9,1 Crít.

    CVE-2026-103882: recorrido de rutas (path traversal) en Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress

    CVE-2026-103882

    T−15d 30 oct. 2026

  8. 7,2 Alta

    CVE-2026-120075: cross-site scripting (XSS) en WP Activity Log

    CVE-2026-120075

    T−15d 30 oct. 2026

  9. 6,4 Media

    CVE-2026-111592: cross-site scripting (XSS) en Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors

    CVE-2026-111592

    T−15d 30 oct. 2026

  10. 6,1 Media

    CVE-2026-103962: cross-site scripting (XSS) en User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission

    CVE-2026-103962

    T−15d 30 oct. 2026

  11. 8,8 Alta

    CVE-2026-120070: gestión incorrecta de privilegios en User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission

    CVE-2026-120070

    T−15d 30 oct. 2026

  12. 5,4 Media

    CVE-2026-111070: cross-site scripting (XSS) en Content Pilot – Autoblogging & Affiliate Marketing Suite

    CVE-2026-111070

    T−15d 30 oct. 2026

  13. 9,8 Crít.

    CVE-2026-116512: subida de ficheros peligrosos en Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker

    CVE-2026-116512

    T−15d 30 oct. 2026

  14. 5,9 Media

    CVE-2026-110023: falta de autorización en WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps

    CVE-2026-110023

    T−15d 30 oct. 2026

  15. 8,1 Alta

    CVE-2026-103898: autenticación incorrecta en Wp Social Login and Register Social Counter

    CVE-2026-103898

    T−15d 30 oct. 2026

  16. 9,8 Crít.

    CVE-2026-119096: autenticación incorrecta en Uncanny Toolkit for LearnDash

    CVE-2026-119096

    T−15d 30 oct. 2026

  17. 6,5 Media

    CVE-2026-103997: falta de autorización en Redux Framework

    CVE-2026-103997

    T−15d 30 oct. 2026

  18. 8,8 Alta

    CVE-2026-104012: gestión incorrecta de privilegios en Rox Appointment Booking – Event, Calendar & Appointment Scheduling

    CVE-2026-104012

    T−15d 30 oct. 2026

  19. 7,2 Alta

    CVE-2026-107759: cross-site scripting (XSS) en WPO365 | MICROSOFT 365 GRAPH MAILER

    CVE-2026-107759

    T−15d 30 oct. 2026

  20. 6,5 Media

    CVE-2025-9462: inyección SQL en WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden

    CVE-2025-9462

    T−15d 30 oct. 2026

  21. 6,4 Media

    CVE-2026-116535: cross-site scripting (XSS) en SEOPress – AI SEO Plugin & On-site SEO

    CVE-2026-116535

    T−15d 30 oct. 2026

  22. 7,2 Alta

    CVE-2026-118057: cross-site scripting (XSS) en Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning

    CVE-2026-118057

    T−15d 30 oct. 2026

  23. 4,3 Media

    CVE-2025-11455: falta de autorización en Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF

    CVE-2025-11455

    T−15d 30 oct. 2026

  24. 7,5 Alta

    CVE-2026-120040: gestión incorrecta de privilegios en Mail logging & Catcher

    CVE-2026-120040

    T−15d 30 oct. 2026

  25. 7,5 Alta

    CVE-2026-119163: inyección SQL en FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce

    CVE-2026-119163

    T−15d 30 oct. 2026

  26. 6,4 Media

    CVE-2026-107765: cross-site scripting (XSS) en Discussion Board – WordPress Forum Plugin

    CVE-2026-107765

    T−15d 30 oct. 2026

  27. 6,4 Media

    CVE-2026-116546: cross-site scripting (XSS) en WP Job Portal – AI-Powered Recruitment System for Company or Job Board website

    CVE-2026-116546

    T−15d 30 oct. 2026

  28. 4,3 Media

    CVE-2026-109386: falta de autorización en Hustle – Email Marketing, Lead Generation, Optins, Popups

    CVE-2026-109386

    T−15d 30 oct. 2026

  29. 7,2 Alta

    CVE-2026-107750: cross-site scripting (XSS) en PDF Invoices & Packing Slips for WooCommerce

    CVE-2026-107750

    T−15d 30 oct. 2026

  30. 5,3 Media

    CVE-2026-109217: vulnerabilidad en PDF Invoices & Packing Slips for WooCommerce

    CVE-2026-109217

    T−15d 30 oct. 2026