Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-8688

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to duplicate, copy, move, or publish nav_menu_item posts via wp_insert_post(), modifying the site&#39;s navigation menus without authorization.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-8690

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The RentMy Real-Time Rental Management Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, and delete event records stored in the rentmy_events WordPress option, as well as overwrite the rentmy_locationId option.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-8705

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in all versions up to, and including, 3.4.2. The handler is registered for unauthenticated users (`wp_ajax_nopriv_clearsale_total_push`), and although a `wp_verify_nonce()` check exists, the failing branch&#39;s `die()` is commented out so execution continues regardless of nonce validity. On PHP

Gravedad CVSS v3.1: ALTA

Última modificación:

25/06/2026

CVE-2026-8905

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-9172

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to unauthorized modification/deletion of data due to a missing capability check on the delete_single_account() function in versions up to, and including, 1.2.0. The REST route &#39;devs-accounting/v1/delete-account/(?P\d+)&#39; is registered without any permission_callback, which causes WordPress to expose the endpoint to public, unauthenticated access. This makes it possible for unauthenticated attackers to soft-delete arbitrary accounting account records (wp_dac_accounts) by issuing a simple GET request to the endpoint with any account ID.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-8896

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;title&#39; attribute (and other attributes such as &#39;ready_animation_text&#39;) of the &#39;msc_stats&#39; shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes inside the msc_stats() rendering function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/06/2026

CVE-2026-8617

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, and including, 1.7.1. This is due to a missing capability check and missing nonce validation on the searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() functions, both of which are exposed to unauthenticated users through the wp_ajax_nopriv_ hooks. This makes it possible for unauthenticated attackers to overwrite or delete the plugin&#39;s stored account token and account name options (dym_token, dym_name, searchplus_token, searchplus_name, sp_token, sp_name).

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-4297

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() (verifying credentials are valid) but does not perform any authorization check such as current_user_can(&#39;manage_options&#39;). This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary WordPress options via XML-RPC requests. This can be leveraged to change the default_role option to &#39;administrator&#39; and then register a new administrator account, achieving full privilege escalation and site takeover.

Gravedad CVSS v3.1: ALTA

Última modificación:

25/06/2026

CVE-2026-6292

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This is due to a completely broken nonce validation in the enter_mpclp_login_options() function, which contains an inverted check (if wp_verify_nonce(...) { return false; }) and is missing the required action parameter for wp_verify_nonce(). As a result, the nonce check is effectively dead code: it never blocks malicious requests because a CSRF-supplied empty/invalid nonce always returns false, satisfying the inverted condition to continue execution. Furthermore, the settings-update handler is hooked on init without any capability check. This makes it possible for unauthenticated attackers to modify all plugin setting, including login page background, logo URL, image dimensions, button colors, and login message, by tricking a logged-in administrator into submitting a crafted request.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-7617

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Secufor_OAuth plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disconnect the WordPress site from its linked Secufor account by clearing the plugin&#39;s stored login token and user login configuration.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-8614

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Assistio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the assistio_plugin_delete_assistio_settings() function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin&#39;s options including the critical &#39;assistiobot_oauth_settings&#39; option, which disrupts the plugin&#39;s integration with the Assistio bot service.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-8622

Fecha de publicación:

24/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Image Sizes on Demand plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Server Variable in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The injected payload only executes in the context of an administrator, as the settings page requires the manage_options capability to render.

Gravedad CVSS v3.1: MEDIA

Última modificación:

29/06/2026

Suscribirse a Vulnerabilidades