Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-96840

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core&#39;s pre_user_display_name filter encodes &, but leaves double-quotes intact (ENT_NOQUOTES), allowing a Subscriber-level user to store a double-quote in their display_name via /wp-admin/profile.php that subsequently breaks out of the alt="" attribute at Archive_Title.php:144.

Gravedad CVSS v3.1: ALTA

Última modificación:

10/10/2026

CVE-2026-97348

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The widget&#39;s normal update()/sanitize_field_input() pipeline — which would reject non-hex color values — is bypassed entirely because the [siteorigin_widget] shortcode handler calls $the_widget->widget() directly on the attacker-supplied decoded JSON instance.

Gravedad CVSS v3.1: MEDIA

Última modificación:

10/10/2026

CVE-2026-108503

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.

Gravedad CVSS v3.1: BAJA

Última modificación:

10/10/2026

CVE-2026-12626

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known gadget chain is available.

Gravedad CVSS v3.1: ALTA

Última modificación:

10/10/2026

CVE-2026-15178

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access and above, to read private form submissions, change submission statuses, permanently delete submissions, and modify global plugin settings.

Gravedad CVSS v3.1: MEDIA

Última modificación:

10/10/2026

CVE-2026-3717

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the &#39;wp_save_signature_image&#39; function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to upload arbitrary content to the WordPress uploads directory as png files.

Gravedad CVSS v3.1: MEDIA

Última modificación:

10/10/2026

CVE-2026-5725

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the &#39;fvrt_&#39; prefixed request parameters in all versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Gravedad CVSS v3.1: MEDIA

Última modificación:

10/10/2026

CVE-2026-6243

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the &#39;get_dynamic_values&#39; function performing text-level find-and-replace operations on post content without HTML-aware parsing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Gravedad CVSS v3.1: MEDIA

Última modificación:

10/10/2026

CVE-2026-89100

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via &#39;#response&#39; URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the &#39;Generic Errors&#39; setting is unchecked, causing getErrorMessage() to return the raw Stripe error string unchanged rather than substituting a mapped safe message.

Gravedad CVSS v3.1: MEDIA

Última modificación:

10/10/2026

CVE-2026-103427

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;country&#39; parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers may also exploit this vulnerability when the plugin&#39;s Enable Free Membership feature is turned on, as it permits anonymous front-end registration and profile submission.

Gravedad CVSS v3.1: MEDIA

Última modificación:

10/10/2026

CVE-2026-103897

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;comment&#39; parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin&#39;s &#39;Comments&#39; lightbox setting to be enabled (disabled by default), a moderator to approve the injected comment, and a site visitor to click the affected image to open the lightbox.

Gravedad CVSS v3.1: MEDIA

Última modificación:

10/10/2026

CVE-2026-104006

Fecha de publicación:

10/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the &#39;comment_author_*, comment_author_email_*&#39; parameter. This makes it possible for unauthenticated attackers to extract the full name and email address of returning commenters pre-filled into comment form input fields and persisted as the site-wide cached page by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author_* cookies, but this check is absent on the write path, meaning the cache poisoning is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.

Gravedad CVSS v3.1: BAJA

Última modificación:

10/10/2026

Suscribirse a Vulnerabilidades