Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-96568

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;phone_number&#39; parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Gravedad CVSS v3.1: ALTA

Última modificación:

25/09/2026

CVE-2026-96448

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.

Gravedad CVSS v3.1: MEDIA

Última modificación:

26/09/2026

CVE-2026-93654

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;cart_items[][product_name]&#39; Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it is renderable to any logged-in user who accesses the invoice.

Gravedad CVSS v3.1: ALTA

Última modificación:

25/09/2026

CVE-2026-92609

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

25/09/2026

CVE-2026-92713

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the edit_post check on their own galleries.

Gravedad CVSS v3.1: ALTA

Última modificación:

25/09/2026

CVE-2026-93656

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via a nonce-free GET request to /wp-admin/profile.php, requiring no profile-form submission; a Subscriber can plant the malicious attachment URL, which then executes when an administrator opens that user&#39;s Edit User screen.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/09/2026

CVE-2026-93747

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;telegram&#39; profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profile_update action — the raw $_POST[&#39;data&#39;] array is copied into a $custom_fields variable before validate() and sanitize() run, both of which operate only on a parallel $user reference, leaving $custom_fields unsanitized when it is persisted via update_custom_fields(); on render, wpforo_decode() reverses the entity encoding and the value is echoed without escaping in field_wrap_profile(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/09/2026

CVE-2026-93901

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the `provisionBlogCredentials()` function in `iHomefinderAdmin.php` being reachable via the `wp_ajax_nopriv_ihf_clear_cache` AJAX action — through the call chain `iHomefinderAjaxHandler::clearCache()` → `activateAuthenticationToken()` → `getAuthenticationInfo()` → `provisionBlogCredentials()` — with no capability check, nonce verification, or ownership validation, and the function unconditionally calling `$user->set_role(&#39;author&#39;)` on whichever WordPress account matches the hard-coded login `optima-express` via `get_user_by(&#39;login&#39;, &#39;optima-express&#39;)`. This makes it possible for unauthenticated attackers to escalate a pre-registered `optima-express` account to the Author role, gaining `publish_posts`, `upload_files`, and `edit_published_posts` capabilities, including access to the plugin&#39;s own `/wp-json/optima-express/v1/blog-post` REST endpoint. Exploitation requires open user registration to be enabled on the target site, and the attacker must register the `optima-express` username before the plugin has had the opportunity to provision that login for its own integration account.

Gravedad CVSS v3.1: ALTA

Última modificación:

25/09/2026

CVE-2026-92608

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Gravedad CVSS v3.1: ALTA

Última modificación:

25/09/2026

CVE-2026-17577

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the &#39;uri&#39; (and &#39;host&#39;) parameters in versions up to, and including, 4.7.42. The ssl_zen_messages::getMessages() function builds the &#39;token_missmatch&#39; message using base64_decode(sanitize_text_field($_REQUEST[&#39;uri&#39;])) and (optionally) base64_decode(sanitize_text_field($_REQUEST[&#39;host&#39;])). sanitize_text_field() cannot strip HTML/JavaScript that is hidden inside a base64-encoded blob, and the resulting decoded raw HTML is echoed unescaped by showMessage() . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/09/2026

CVE-2026-88996

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via &#39;page_title&#39; POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on forms whose admin-authored confirmation message places the {page_title} Smart Tag inside an HTML attribute context.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/09/2026

CVE-2026-17602

Fecha de publicación:

25/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the &#39;file_name&#39; parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/09/2026

Suscribirse a Vulnerabilidades