Saltar al contenido

Radar en marcha

Bastion/Radar

[■] Gestor de contenidos

WordPress

Web oficial

43.917 expedientes en el radar

Comprueba tu versión de WordPress Sólo las que se están explotando

[■] Para hacerlo bien

Guías

[■] Registro

Vulnerabilidades (43.917)

  1. 6,1 Media

    CVE-2026-103998: cross-site scripting (XSS) en Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

    CVE-2026-103998

    T−36d 9 oct. 2026

  2. 4,7 Media

    CVE-2026-101324: cross-site scripting (XSS) en Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

    CVE-2026-101324

    T−36d 9 oct. 2026

  3. 5,3 Media

    CVE-2026-104724: inyección SQL en FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment

    CVE-2026-104724

    T−36d 9 oct. 2026

  4. 6,1 Media

    CVE-2026-87869: cross-site scripting (XSS) en Filter Everything — WordPress & WooCommerce Filters

    CVE-2026-87869

    T−36d 9 oct. 2026

  5. 6,4 Media

    CVE-2026-104735: cross-site scripting (XSS) en RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

    CVE-2026-104735

    T−36d 9 oct. 2026

  6. 7,2 Alta

    CVE-2026-104021: inyección de código en Fastcache by Host.it

    CVE-2026-104021

    T−36d 9 oct. 2026

  7. 9,8 Crít.

    CVE-2026-103889: subida de ficheros peligrosos en 3D Product configurator for WooCommerce

    CVE-2026-103889

    T−36d 9 oct. 2026

  8. 5,4 Media

    CVE-2026-103424: cross-site scripting (XSS) en Anti-Spam, Spam FireWall by CleanTalk

    CVE-2026-103424

    T−36d 9 oct. 2026

  9. 4,3 Media

    CVE-2026-103964: exposición de información sensible en Download Manager

    CVE-2026-103964

    T−36d 9 oct. 2026

  10. 6,4 Media

    CVE-2026-102401: cross-site scripting (XSS) en Download Manager

    CVE-2026-102401

    T−36d 9 oct. 2026

  11. 6,4 Media

    CVE-2026-96648: cross-site scripting (XSS) en Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables

    CVE-2026-96648

    T−36d 9 oct. 2026

  12. 7,5 Alta

    CVE-2026-89301: falta de autorización en rtMedia for WordPress, BuddyPress and bbPress

    CVE-2026-89301

    T−36d 9 oct. 2026

  13. 9,8 Crít.

    CVE-2026-94589: subida de ficheros peligrosos en Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)

    CVE-2026-94589

    T−36d 9 oct. 2026

  14. 6,8 Media

    CVE-2026-104898: acceso a datos de otros usuarios (IDOR) en Online Scheduling and Appointment Booking System – Bookly

    CVE-2026-104898

    T−36d 9 oct. 2026

  15. 5,3 Media

    CVE-2026-103365: exposición de información sensible en Online Scheduling and Appointment Booking System – Bookly

    CVE-2026-103365

    T−36d 9 oct. 2026

  16. 9,1 Crít.

    CVE-2026-107645: gestión incorrecta de privilegios en Blocksy Companion

    CVE-2026-107645

    T−36d 9 oct. 2026

  17. 9,8 Crít.

    CVE-2026-104732: autenticación incorrecta en Advanced IP Blocker

    CVE-2026-104732

    T−36d 9 oct. 2026

  18. 8,1 Alta

    CVE-2026-104797: autenticación incorrecta en Advanced Form Integration — Connect Forms to 300+ Apps

    CVE-2026-104797

    T−36d 9 oct. 2026

  19. 6,4 Media

    CVE-2026-96743: cross-site scripting (XSS) en Table Field Add-on for ACF and SCF

    CVE-2026-96743

    T−36d 9 oct. 2026

  20. 6,4 Media

    CVE-2026-93883: cross-site scripting (XSS) en Advanced Classifieds & Directory Pro

    CVE-2026-93883

    T−36d 9 oct. 2026

  21. 6,5 Media

    CVE-2026-104915: falta de autorización en Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning

    CVE-2026-104915

    T−36d 9 oct. 2026

  22. 8,8 Alta

    CVE-2026-62024: subida de ficheros peligrosos en CodeBard Help Desk

    CVE-2026-62024

    T−36d 9 oct. 2026

  23. 9,8 Crít.

    CVE-2026-62025: subida de ficheros peligrosos en Tailored Tools

    CVE-2026-62025

    T−36d 9 oct. 2026

  24. 5,3 Media

    CVE-2026-62043: exposición de información sensible en DTX – Dynamic Text Extension for Contact Form 7

    CVE-2026-62043

    T−36d 9 oct. 2026

  25. 7,5 Alta

    CVE-2026-62031: inyección SQL en Directory Listings WordPress plugin – uListing

    CVE-2026-62031

    T−36d 9 oct. 2026

  26. 7,2 Alta

    CVE-2026-62027: cross-site scripting (XSS) en Team Section Block – Showcase Team Members with Layout Options

    CVE-2026-62027

    T−36d 9 oct. 2026

  27. 7,2 Alta

    CVE-2026-62030: falsificación de peticiones del servidor (SSRF) en StreamCast – bring live radio to your site with a sleek player

    CVE-2026-62030

    T−36d 9 oct. 2026

  28. 7,2 Alta

    CVE-2026-62037: cross-site scripting (XSS) en Document Embedder – let visitors read files without downloading

    CVE-2026-62037

    T−36d 9 oct. 2026

  29. 8,1 Alta

    CVE-2026-62032: inclusión de ficheros en PHP en DirectoryPress – Business Directory And Classified Ad Listing

    CVE-2026-62032

    T−36d 9 oct. 2026

  30. 7,2 Alta

    CVE-2026-62034: cross-site scripting (XSS) en Before After Image Comparison – Visual Comparison for Two Images

    CVE-2026-62034

    T−36d 9 oct. 2026