Vulnerabilidades

CVE-2026-120687: cross-site scripting (XSS) en Lightbox & Modal Popup WordPress Plugin – FooBox

CVE-2026-120687 · 66b5a5a2-8f70-4a85-ad03-8bd159cafdf5

CVE-2026-110531: cross-site scripting (XSS) en FV Player 8

CVE-2026-110531 · 4d581f96-5a30-49f7-bddf-45dd581d7a24

CVE-2026-127115: cross-site scripting (XSS) en BuddyForms

CVE-2026-127115 · 9e2f180b-fd81-4dfd-b264-d9ca74fdd092

CVE-2026-116753: cross-site scripting (XSS) en Multi Step for Contact Form 7

CVE-2026-116753 · b9700627-97f2-4da1-a984-934062bd5014

CVE-2026-19907: autenticación incorrecta en Shipo

CVE-2026-19907 · ce5ea515-5ae1-4771-9bfb-5a0f4b3fce22

CVE-2026-120522: recorrido de rutas (path traversal) en Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads

CVE-2026-120522 · 58fd04ae-fff2-42b1-ae98-168195d84290

CVE-2026-18053: acceso a datos de otros usuarios (IDOR) en MemberDash

CVE-2026-18053 · 70d0bc5e-8db6-4a42-af19-d41280ec1207

CVE-2026-18742: cross-site scripting (XSS) en Flatsome

CVE-2026-18742 · d6567c87-9e69-4e18-bea3-08d8aae23ef6

CVE-2026-128083: deserialización de datos no fiables en laravel/framework

CVE-2026-128083 · GHSA-63HM-G96R-2M2Q

CVE-2026-124969: deserialización de datos no fiables en Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

CVE-2026-124969 · 277b9a34-8e0b-496e-b07b-602b25f125d8

CVE-2026-126173: falta de autorización en AutomatorWP Webhooks

CVE-2026-126173 · 04ea5758-2400-4885-8342-c57d61206ef1

CVE-2026-120688: cross-site scripting (XSS) en EZ SQL Reports Shortcode Widget and DB Backup

CVE-2026-120688 · 376eec5d-a629-4765-8ace-09e21bf3c2e8

CVE-2026-125055: subida de ficheros peligrosos en Chatterbug Forms – Fast, Flexible WordPress Form Builder

CVE-2026-125055 · 7819c1fa-884b-4f1d-ba63-84057bf6da84

CVE-2026-119077: deserialización de datos no fiables en ELEX WordPress HelpDesk & Customer Ticketing System

CVE-2026-119077 · f14b07ce-8893-4f8c-a501-5da6ec5a3b8f

CVE-2026-121518: exposición de información sensible en Customer Reviews for WooCommerce

CVE-2026-121518 · e93acf29-8ff0-4412-9ff0-161f154b4311

CVE-2026-124218: recorrido de rutas (path traversal) en Drag and Drop File Upload for Elementor Forms

CVE-2026-124218 · ee73bfb0-843c-4b4a-b513-3980c1cefac1

CVE-2026-122063: inyección SQL en Newsletters

CVE-2026-122063 · 68348c03-d0ba-4dcc-8b18-a4675d6dce27

CVE-2026-122227: inyección SQL en Easy Property Listings

CVE-2026-122227 · eb0389e2-ab65-4652-a3e9-521dfd2e54a8

CVE-2026-115871: vulnerabilidad en WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups

CVE-2026-115871 · 0bfa1392-375a-4be2-ad4d-2c9d5fe3267c

CVE-2026-126029: cross-site scripting (XSS) en WPZOOM Addons for Elementor – Starter Templates & Widgets

CVE-2026-126029 · f25b6009-0edb-4acd-97a3-c24e6e51fecc

CVE-2026-116614: inyección SQL en WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping

CVE-2026-116614 · 7cecb044-2dba-494f-b85c-41bafa69e330

CVE-2026-120573: cross-site scripting (XSS) en WPeMatico RSS Feed Fetcher

CVE-2026-120573 · d93d4360-b66c-499a-838c-e8eea36bd364

CVE-2026-116615: inyección de código en Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets

CVE-2026-116615 · 3f5e4431-2789-47c8-81ce-e9f67454accc

CVE-2026-123769: gestión incorrecta de privilegios en SureDash – Community, Courses & Member Dashboard

CVE-2026-123769 · 2f317dcd-dc4f-482a-8faa-91cd9c022276

CVE-2026-118587: cross-site scripting (XSS) en PowerPress Podcasting plugin by Blubrry

CVE-2026-118587 · f5d3930f-d2da-4992-ad3a-228ffd7a5a6c

CVE-2026-118191: recorrido de rutas (path traversal) en Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

CVE-2026-118191 · b4e01402-f866-43b9-9fef-7e9b156a9e0d

CVE-2026-125948: cross-site scripting (XSS) en Recipe Card Blocks Lite

CVE-2026-125948 · 8ed1f200-d4ae-4c9e-a618-fbeb58c0f3f3

CVE-2026-116509: inyección SQL en Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker

CVE-2026-116509 · cbca9065-6f0a-4fb3-ba54-ebd8a7c44af1

CVE-2026-120547: cross-site scripting (XSS) en CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)

CVE-2026-120547 · 3091d345-2532-433c-83e0-2e253a4cd8d4

CVE-2026-120658: cross-site scripting (XSS) en Download Manager

CVE-2026-120658 · b4085834-3865-4b9e-9497-f14e6e32554b