Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-16042

Publication date:

02/08/2026

The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site&#39;s caches and force repeated cache rebuilds.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2026

CVE-2026-16062

Publication date:

02/08/2026

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 itself, but if one is present via another installed Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 or , this could lead to actions such as arbitrary file deletion, sensitive data retrieval, or remote code execution. This is an incomplete fix of the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7&#39;s earlier object-injection advisories.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2026

CVE-2026-15241

Publication date:

02/08/2026

The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner&#39;s stored third-party API key to send requests billed to the owner&#39;s account and, when an optional feature is enabled, to retrieve indexed knowledge-base content.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2026

CVE-2026-15385

Publication date:

02/08/2026

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2026

CVE-2026-15248

Publication date:

02/08/2026

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2026

CVE-2026-15939

Publication date:

02/08/2026

The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9&#39;s own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2026

CVE-2026-15151

Publication date:

02/08/2026

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23&#39;s settings) to reset the site&#39;s configured booking notification rules.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2026

CVE-2026-15206

Publication date:

02/08/2026

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2026

CVE-2026-15236

Publication date:

02/08/2026

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2026

CVE-2026-14841

Publication date:

02/08/2026

The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2026

CVE-2026-14864

Publication date:

02/08/2026

The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.

Severity CVSS v4.0: Pending analysis

Last modification:

03/08/2026