Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas3224▲ 662 respecto a la semana anterior
Críticas / altas1515▲ 132 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 1 respecto a la semana anterior
Sin puntuar (sin CVSS)236▲ 222 respecto a la semana anterior
3264 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Alta (7.5) | 3.6% | 💥 Exploit | Tshirtecommerce Custom Product Designer | 1/6/2023 | 17/6/2026 | An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter file_name in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to open files… | |
| Modificada | Media (6.1) | 0.95% | 💥 Exploit | Themeisle Product Addons & Fields FOR Woocommerce | 30/5/2023 | 17/6/2026 | The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting. | |
| Modificada | Alta (8.8) | 0.26% | — | Codeixer Product Gallery Slider FOR Woocommerce | 29/5/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions. | |
| Modificada | Media (6.1) | 0.38% | — | Woocommerce Product Vendors Project Woocommerce Product Vendors | 28/5/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions. | |
| Modificada | Media (6.1) | 0.38% | — | Woocommerce Automatewoo | 28/5/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions. | |
| Modificada | Alta (8.8) | 0.25% | — | Woocommerce Automatewoo | 28/5/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions. | |
| Modificada | Alta (8.8) | 0.30% | — | Pluginus Bear - Woocommerce Bulk Editor AND Products Manager Professional | 28/5/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR plugin <= 1.1.3.1 versions. | |
| Modificada | Media (4.8) | 0.37% | — | Gvectors Woodiscuz - Woocommerce Comments | 28/5/2023 | 17/6/2026 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9. | |
| Modificada | Alta (8.8) | 0.26% | — | Orion Woocommerce Products Designer | 25/5/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in ORION Woocommerce Products Designer plugin <= 4.3.3 versions. | |
| Modificada | Alta (8.8) | 0.23% | — | Villatheme Woocommerce Thank YOU Page Customizer | 25/5/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions. | |
| Modificada | Alta (8.8) | 0.26% | — | Tychesoftwares Custom Order Numbers FOR Woocommerce | 25/5/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Custom Order Numbers for WooCommerce plugin <= 1.4.0 versions. | |
| Modificada | Alta (8.8) | 0.29% | — | Mage-people Event Manager AND Tickets Selling Plugin FOR Woocommerce | 25/5/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions. | |
| Modificada | Alta (8.8) | 0.26% | — | Villatheme Woocommerce Thank YOU Page Customizer | 25/5/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions. | |
| Modificada | Alta (8.8) | 0.26% | — | Zorem Advanced Shipment Tracking FOR Woocommerce | 25/5/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in Zorem Advanced Shipment Tracking for WooCommerce plugin <= 3.5.2 versions. | |
| Modificada | Alta (8.8) | 0.25% | — | Weightbasedshipping Woocommerce Weight Based Shipping | 24/5/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in weightbasedshipping.Com WooCommerce Weight Based Shipping plugin <= 5.4.1 versions. | |
| Modificada | Alta (8.8) | 0.27% | — | Xootix Side Cart Woocommerce | 22/5/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in XootiX Side Cart Woocommerce (Ajax) < 2.1 versions. | |
| Modificada | Media (5.4) | 0.36% | — | Berocket Brands FOR Woocommerce | 18/5/2023 | 17/6/2026 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in BeRocket Brands for WooCommerce plugin <= 3.7.0.6 versions. | |
| Modificada | Alta (8.1) | 1.7% | — | Xootix OTP Login Woocommerce & Gravity Forms | 17/5/2023 | 17/6/2026 | The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to… | |
| Modificada | Media (6.5) | 0.34% | — | Woocommerce Order Status Change Notifier | 15/5/2023 | 17/6/2026 | The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without… | |
| Modificada | Media (4.8) | 0.46% | — | Themeisle Product Addons & Fields FOR Woocommerce | 15/5/2023 | 17/6/2026 | The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite… | |
| Modificada | Media (6.1) | 0.38% | — | Woocommerce Custom Checkout Fields Editor With Drag & Drop Project Woocommerce Custom Checkout Fields Editor With Drag & Drop | 9/5/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Umair Saleem Woocommerce Custom Checkout Fields Editor With Drag & Drop plugin <= 0.1 versions. | |
| Modificada | Media (6.1) | 0.38% | — | Product Specifications FOR Woocommerce Project Product Specifications FOR Woocommerce | 9/5/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Amin A.Rezapour Product Specifications for Woocommerce plugin <= 0.6.0 versions. | |
| Modificada | Media (6.1) | 0.38% | — | Woocommerce Jazzcash Gateway | 9/5/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in JC Development Team WooCommerce JazzCash Gateway Plugin plugin <= 2.0 versions. | |
| Modificada | Media (6.1) | 0.38% | — | Return AND Warranty Management System FOR Woocommerce Project Return AND Warranty Management System FOR Woocommerce | 8/5/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in chilidevs Return and Warranty Management System for WooCommerce plugin <= 1.2.3 versions. | |
| Modificada | Media (5.4) | 0.39% | — | Lightspeedhq Ecwid Ecommerce Shopping Cart | 8/5/2023 | 17/6/2026 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.4 versions. |