Saltar al contenido

Radar en marcha

Bastion/Radar

[■] Gestor de contenidos

WordPress

Web oficial

43.917 expedientes en el radar

Comprueba tu versión de WordPress Sólo las que se están explotando

[■] Para hacerlo bien

Guías

[■] Registro

Vulnerabilidades (43.917)

  1. 4,3 Media

    CVE-2026-39444: acceso a datos de otros usuarios (IDOR) en Issues and Series for Newspapers, Magazines, Publishers, Writers

    CVE-2026-39444

    T−43d 2 oct. 2026

  2. 4,3 Media

    CVE-2026-39439: falta de autorización en WebSamurai

    CVE-2026-39439

    T−43d 2 oct. 2026

  3. 4,3 Media

    CVE-2026-32585: falta de autorización en Airano MCP Bridge

    CVE-2026-32585

    T−43d 2 oct. 2026

  4. 5,3 Media

    CVE-2026-32584: exposición de información sensible en Smart One Click Setup – Complete Demo Import & Export

    CVE-2026-32584

    T−43d 2 oct. 2026

  5. 6,1 Media

    CVE-2026-92538: cross-site scripting (XSS) en LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

    CVE-2026-92538

    T−43d 2 oct. 2026

  6. 6,1 Media

    CVE-2026-92551: cross-site scripting (XSS) en ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content

    CVE-2026-92551

    T−43d 2 oct. 2026

  7. 8,8 Alta

    CVE-2026-92536: inyección de código en ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content

    CVE-2026-92536

    T−43d 2 oct. 2026

  8. 6,1 Media

    CVE-2026-92826: cross-site scripting (XSS) en EWWW Image Optimizer

    CVE-2026-92826

    T−43d 2 oct. 2026

  9. 6,4 Media

    CVE-2026-92727: cross-site scripting (XSS) en EmbedPress

    CVE-2026-92727

    T−43d 2 oct. 2026

  10. 6,5 Media

    CVE-2026-95865: inyección SQL en Beaver Builder Page Builder – Drag and Drop Website Builder

    CVE-2026-95865

    T−43d 2 oct. 2026

  11. 6,4 Media

    CVE-2026-94378: cross-site scripting (XSS) en SupportCandy – Helpdesk, Support Ticket System & AI Chatbot

    CVE-2026-94378

    T−43d 2 oct. 2026

  12. 6,1 Media

    CVE-2026-92243: cross-site scripting (XSS) en Ivory Search – WordPress Search Plugin

    CVE-2026-92243

    T−43d 2 oct. 2026

  13. 6,5 Media

    CVE-2026-94539: inyección SQL en SupportCandy – Helpdesk, Support Ticket System & AI Chatbot

    CVE-2026-94539

    T−43d 2 oct. 2026

  14. 7,5 Alta

    CVE-2026-93428: falta de autorización en Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    CVE-2026-93428

    T−43d 2 oct. 2026

  15. 5,4 Media

    CVE-2026-100180: cross-site scripting (XSS) en Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

    CVE-2026-100180

    T−43d 2 oct. 2026

  16. 7,2 Alta

    CVE-2026-96270: cross-site scripting (XSS) en Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    CVE-2026-96270

    T−43d 2 oct. 2026

  17. 5,3 Media

    CVE-2026-104403: acceso a datos de otros usuarios (IDOR) en LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

    CVE-2026-104403

    T−44d 2 oct. 2026

  18. 4,3 Media

    CVE-2026-94180: exposición de información sensible en Advanced Ads – Ad Manager & AdSense

    CVE-2026-94180

    T−44d 2 oct. 2026

  19. 5,3 Media

    CVE-2026-94405: exposición de información sensible en Download Manager

    CVE-2026-94405

    T−44d 2 oct. 2026

  20. 7,5 Alta

    CVE-2026-95605: inyección SQL en WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps

    CVE-2026-95605

    T−44d 2 oct. 2026

  21. 5,3 Media

    CVE-2026-97307: exposición de información sensible en Cost Calculator Builder

    CVE-2026-97307

    T−44d 2 oct. 2026

  22. 6,5 Media

    CVE-2026-95607: inyección SQL en WPLMS Learning Management System for WordPress, WordPress LMS

    CVE-2026-95607

    T−44d 2 oct. 2026

  23. 6,1 Media

    CVE-2026-95608: cross-site scripting (XSS) en HUSKY – Products Filter for WooCommerce Professional. MCP is onboard

    CVE-2026-95608

    T−44d 2 oct. 2026

  24. 6,1 Media

    CVE-2026-94670: cross-site scripting (XSS) en Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

    CVE-2026-94670

    T−44d 2 oct. 2026

  25. 6,1 Media

    CVE-2026-95595: cross-site scripting (XSS) en Disable and Remove Google Fonts | GDPR & DSGVO friendly

    CVE-2026-95595

    T−44d 2 oct. 2026

  26. 7,5 Alta

    CVE-2026-95610: inyección SQL en UpSolution Core

    CVE-2026-95610

    T−44d 2 oct. 2026

  27. 5,3 Media

    CVE-2026-96461: falta de autorización en Booking for Appointments and Events Calendar – Amelia

    CVE-2026-96461

    T−44d 2 oct. 2026

  28. 4,3 Media

    CVE-2026-96337: falta de autorización en ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content

    CVE-2026-96337

    T−44d 2 oct. 2026

  29. 5,3 Media

    CVE-2026-96518: falta de autorización en ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content

    CVE-2026-96518

    T−44d 2 oct. 2026

  30. 6,1 Media

    CVE-2026-96553: cross-site scripting (XSS) en FiboSearch – Ajax Search for WooCommerce

    CVE-2026-96553

    T−44d 2 oct. 2026