Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2739▼ 510 respecto a la semana anterior
Críticas / altas1303▼ 212 respecto a la semana anterior
Nueva explotación activa (KEV)3▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)225▼ 276 respecto a la semana anterior
721 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Media (6.1) | 0.33% | — | Arrowplugins Social Feed | 17/10/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Arrow Plugins Social Feed | Custom Feed for Social Media Networks plugin <= 2.2.0 versions. | |
| Modificada | Media (6.1) | 1.6% | 💥 Exploit | Moosocial | 16/10/2023 | 17/6/2026 | Cross Site Scripting vulnerability in mooSocial 3.1.8 allows a remote attacker to obtain sensitive information via a crafted script to the q parameter in the Search function. | |
| Modificada | Media (6.1) | 1.8% | 💥 Exploit | Moosocial | 9/10/2023 | 17/6/2026 | Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function. | |
| Modificada | Media (6.1) | 1.9% | 💥 Exploit | Moosocial | 9/10/2023 | 17/6/2026 | Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function. | |
| Modificada | Alta (8.8) | 0.89% | 💥 PoC | Moosocial | 9/10/2023 | 17/6/2026 | Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function. | |
| Modificada | Alta (8.8) | 0.25% | — | Sumo Social Share Boost | 6/10/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in Sumo Social Share Boost plugin <= 4.5 versions. | |
| Modificada | Crítica (9.8) | 0.95% | — | Knowband ONE Page Checkout, Social Login & Mailchimp | 5/10/2023 | 17/6/2026 | SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to execute arbitrary code via a crafted request to the updateCheckoutBehaviour function in the supercheckout.php component. | |
| Modificada | Alta (8.8) | 0.44% | — | Mekshq Meks Audio PlayerMekshq Meks Easy ADS WidgetMekshq Meks Easy MapsMekshq Meks Easy Photo Feed Widget+6 | 3/10/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the… | |
| Modificada | Media (4.8) | 0.37% | — | Riyaz Social Metrics | 2/10/2023 | 17/6/2026 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Riyaz Social Metrics plugin <= 2.2 versions. | |
| Modificada | Media (4.8) | 0.39% | — | Walkswithme Social Share ON Image Hover | 2/10/2023 | 17/6/2026 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jobin Jose WWM Social Share On Image Hover plugin <= 2.2 versions. | |
| Modificada | Media (6.5) | 2.1% | 💥 Exploit | Moosocial | 28/9/2023 | 17/6/2026 | mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, data[wall_photo], data[userShareVideo] and data[userShareLink]. | |
| Modificada | Media (6.1) | 0.41% | — | Ultimatelysocial Social Media Share Buttons & Social Sharing Icons | 27/9/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UltimatelySocial Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.3 versions. | |
| Modificada | Media (6.1) | 2.0% | 💥 Exploit | Moosocial | 26/9/2023 | 17/6/2026 | A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL. | |
| Modificada | Media (6.1) | 1.7% | 💥 Exploit | Moosocial | 25/9/2023 | 17/6/2026 | A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL. | |
| Modificada | Media (6.1) | 1.1% | 💥 PoC | Moosocial | 14/9/2023 | 17/6/2026 | Cross Site Scripting vulnerability in mooSocial mooSocial Software 3.1.6 and 3.1.7 allows a remote attacker to execute arbitrary code via a crafted script to the edit_menu, copuon, and group_categorias functions. | |
| Modificada | Alta (8.8) | 1.3% | 💥 PoC | Moosocial | 14/9/2023 | 17/6/2026 | Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the Delete Account and Deactivate functions. | |
| Modificada | Media (6.1) | 0.41% | — | Adenion Blog2social | 6/9/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Blog2Social, Adenion Blog2Social: Social Media Auto Post & Scheduler plugin <= 7.2.0 versions. | |
| Modificada | Media (6.4) | 0.42% | — | Wordpress Social Login Project Wordpress Social Login | 6/9/2023 | 17/6/2026 | The WordPress Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wordpress_social_login_meta' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers… | |
| Modificada | Media (4.8) | 0.37% | — | Sumo Social Share Boost | 1/9/2023 | 17/6/2026 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sumo Social Share Boost plugin <= 4.4 versions. | |
| Modificada | Media (4.8) | 0.37% | — | Web-settler Image Social Feed | 1/9/2023 | 17/6/2026 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Image Social Feed plugin <= 1.7.6 versions. | |
| Modificada | Media (4.8) | 0.44% | — | Miled Wordpress Social Login | 30/8/2023 | 17/6/2026 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions. | |
| Modificada | Media (6.1) | 0.45% | — | Miled Wordpress Social Login | 30/8/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions. | |
| Modificada | Media (6.1) | 0.90% | 💥 Exploit | Adenion Blog2social | 21/8/2023 | 17/6/2026 | The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |
| Modificada | Crítica (9.8) | 0.52% | — | Fobybus Social-media-skeleton | 18/8/2023 | 17/6/2026 | Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage the lifecycle of a user's session. Social media skeleton… | |
| Modificada | Alta (7.5) | 0.66% | — | Fobybus Social-media-skeleton | 18/8/2023 | 17/6/2026 | Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been… |