Seguridad WordPress

Base de datos de vulnerabilidades

Fuente base: WPScan. Cada ficha puede incluir enriquecimiento editorial con IA para contexto técnico, impacto y mitigación.

Buscar

Tipo

Severidad

41.798 vulnerabilidades

wordpress

380

plugin

38306

theme

3112

MEDIUM CVSS 4.9

PLUGIN sqli CVE-2024-48043

ShortPixel Image Optimizer <= 5.6.3 - Authenticated (Editor+) SQL Injection

shortpixel-image-optimiser

Publicado: 13/10/2024

Se ha identificado una vulnerabilidad de inyección SQL en el plugin ShortPixel Image Optimizer, que afecta a las versiones hasta la 5.6.3. Esta falla perm…

HIGH CVSS 7.2

PLUGIN rce CVE-2024-48042

Contact Form by Supsystic <= 1.7.28 - Authenticated (Admin+) Remote Code Execution

contact-form-by-supsystic

Publicado: 13/10/2024

Se ha identificado una vulnerabilidad crítica en el plugin 'Contact Form by Supsystic' que permite la ejecución remota de código si un usuario autenticado…

MEDIUM CVSS 6.1

PLUGIN xss CVE-2024-9592

Easy PayPal Gift Certificate <= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wpppgc_plugin_options

paypal-gift-certificate

Publicado: 11/10/2024

Se ha identificado una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) que puede llevar a un ataque de Cross-Site Scripting (XSS) en el plugin Ea…

MEDIUM CVSS 4.3

PLUGIN csrf CVE-2024-9778

ImagePress – Image Gallery <= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update

image-gallery

Publicado: 11/10/2024

Se ha identificado una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el plugin ImagePress – Image Gallery, que afecta a las versiones hasta …

MEDIUM CVSS 4.3

PLUGIN CVE-2024-9824

ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update

image-gallery

Publicado: 11/10/2024

Se ha identificado una vulnerabilidad en el plugin ImagePress - Image Gallery en versiones hasta la 1.2.2, que permite a usuarios autenticados con rol de …

MEDIUM CVSS 4.3

PLUGIN CVE-2024-9187

Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

mynx-page-builder

Publicado: 11/10/2024

Se ha identificado una vulnerabilidad de tipo Cross-Site Scripting (XSS) en el plugin Mynx Page Builder, que afecta a las versiones hasta la 0.27.8. Esta …

MEDIUM CVSS 4.4

PLUGIN xss CVE-2024-9776

ImagePress - Image Gallery <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings

image-gallery

Publicado: 11/10/2024

Se ha identificado una vulnerabilidad de tipo Cross-Site Scripting (XSS) en el plugin ImagePress - Image Gallery, que afecta a versiones hasta la 1.2.2. E…

MEDIUM CVSS 6.1

PLUGIN xss CVE-2024-9670

2D Tag Cloud <= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parameter

2d-tag-cloud-widget-by-sujin

Publicado: 11/10/2024

Se ha identificado una vulnerabilidad de tipo Cross-Site Scripting (XSS) en el plugin 2D Tag Cloud, que afecta a las versiones anteriores a la 6.0.2. Esta…

MEDIUM CVSS 4.3

PLUGIN rce CVE-2024-9756

Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload

order-attachments-for-woocommerce

Publicado: 11/10/2024

Se ha identificado una vulnerabilidad de ejecución remota de código en el plugin 'Order Attachments for WooCommerce' en versiones desde 2.0 hasta 2.4.1. E…

MEDIUM CVSS 6.4

PLUGIN xss CVE-2024-9704

Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

dvk-social-sharing

Publicado: 11/10/2024

Se ha identificado una vulnerabilidad de tipo Cross-Site Scripting (XSS) en el plugin 'Social Sharing' de Danny, afectando a versiones hasta la 1.3.7. Est…

CRITICAL CVSS 9.8

PLUGIN lfi CVE-2024-9047

WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php

wp-file-upload

Publicado: 11/10/2024

Se ha identificado una vulnerabilidad crítica en el plugin WordPress File Upload, que permite la lectura y eliminación de archivos arbitrarios a través de…

Base de datos de vulnerabilidades

ShortPixel Image Optimizer <= 5.6.3 - Authenticated (Editor+) SQL Injection

Contact Form by Supsystic <= 1.7.28 - Authenticated (Admin+) Remote Code Execution

Easy PayPal Gift Certificate <= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wpppgc_plugin_options

ImagePress – Image Gallery <= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update

ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update

Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion

Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

ImagePress - Image Gallery <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings

2D Tag Cloud <= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parameter

Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload

Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php