Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-24821

Publication date:

07/03/2022

The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page)

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-24826

Publication date:

07/03/2022

The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-24952

Publication date:

07/03/2022

The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_product_sync_bantch_wise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

12/03/2025

CVE-2021-24953

Publication date:

07/03/2022

The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-24960

Publication date:

07/03/2022

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-24961

Publication date:

07/03/2022

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-25038

Publication date:

07/03/2022

The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-25039

Publication date:

07/03/2022

The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type, wmcc_source_blog and wmcc_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-25098

Publication date:

07/03/2022

The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in admin remove arbitrary posts from the blog via a CSRF attack, which will be put in the trash

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2022-0163

Publication date:

07/03/2022

The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form&#39;s data, which could include sensitive information such as PII depending on the form.

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2022-0205

Publication date:

07/03/2022

The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-24216

Publication date:

07/03/2022

The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files&#39; extension, which allows administrators to upload PHP files on their site, even on multisite installations.

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

Subscribe to Vulnerabilities