Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas3316▲ 443 respecto a la semana anterior
Críticas / altas1523▲ 46 respecto a la semana anterior
Nueva explotación activa (KEV)5→ sin cambios respecto a la semana anterior
Sin puntuar (sin CVSS)177▲ 6 respecto a la semana anterior
1876 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Alta (7.5) | 6.2% | 💥 Exploit | Stylemixthemes Masterstudy LMS | 11/9/2023 | 17/6/2026 | El complemento de WordPress MasterStudy LMS WordPress anterior a 3.0.18 no cuenta con controles adecuados durante el registro, lo que permite que cualquiera se registre en el sitio como instructor. Luego pueden agregar cursos y/o publicaciones. | |
| Modificada | Media (6.1) | 1.4% | 💥 Exploit | Fieldthemes Fieldpopupnewsletter | 8/9/2023 | 17/6/2026 | Se descubrió que FieldPopupNewsletter Prestashop Module v1.0.0 contenía una vulnerabilidad de Cross-Site Scripting (XSS) Reflejado a través del parámetro callback en ajax.php. | |
| Modificada | Media (6.1) | 1.0% | 💥 Exploit | Ajaydsouza Connections ReloadedArchimidismertzanos Atlast BusinessArchimidismertzanos Fashionable StoreArchimidismertzanos Nothing Personal+42 | 4/9/2023 | 17/6/2026 | Todo lo anterior: Tema de WordPress de Aapna hasta 1.3, Tema de WordPress de Anand hasta 1.2, Tema de WordPress de Anfaust hasta 1.1, Tema de WordPress de Arendelle antes de 1.1.13, Tema de WordPress de Atlast Business hasta 1.5.8.5, Tema de WordPress de Bazaar Lite antes de 1.8.6, Tema de WordPress de Brain Power… | |
| Modificada | Media (4.9) | 0.85% | — | Extendthemes Colibri Page Builder | 31/8/2023 | 17/6/2026 | El Colibri Page Builder para WordPress es vulnerable a inyección SQL a través del parámetro 'post_id' en versiones hasta, e incluyendo, 1.0.227 debido a un escape insuficiente en el parámetro proporcionado por el usuario y a la falta de preparación suficiente en la consulta SQL existente. Esto hace posible que… | |
| Modificada | Media (4.8) | 0.37% | — | Hasthemes Wishsuite | 30/8/2023 | 17/6/2026 | Aut. (admin+) vulnerabilidad de cross-site scripting (XSS) almacenado en el plugin HasTheme WishSuite – Wishlist for WooCommerce en versiones <= 1.3.4. | |
| Modificada | Media (6.1) | 0.41% | — | Uxthemes Flatsome | 23/8/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UX-themes Flatsome plugin <= 3.16.8 versions. | |
| Modificada | Media (5.4) | 0.36% | — | Elegantthemes Divi | 8/8/2023 | 17/6/2026 | Vulnerabilidad de Cross-Site Scripting (XSS) Almacenada en las versiones 4.20.2 e inferiores del tema Divi de Elegant themes. Para explotar esta vulnerabilidad hace falta estar autenticado y tener permisos de colaborador o superior. | |
| Modificada | Media (4.8) | 0.37% | — | Nsthemes NS Coupon TO Become Customer | 8/8/2023 | 17/6/2026 | Vulnerabilidad de Cross-Site Scripting (XSS) almacenada en el plugin NS Coupon To Become Customer de NsThemes, que afecta a las versiones1.2.2 e inferiores. Para explotar esta vulnerabilidad hace falta estar autenticado y tener permisos de administrador o superior. | |
| Modificada | Media (6.1) | 0.41% | — | Everestthemes Everest News | 8/8/2023 | 17/6/2026 | Vulnerabilidad de Cross Site Scripting (XSS) Reflejada en el tema Everest News de Everest Themes, que afecta a las versiones 1.1.0 e inferiores. Para explotar esta vulnerabilidad no hace falta estar autenticación. | |
| Modificada | Media (6.1) | 0.38% | — | Everestthemes Mocho Blog | 8/8/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest themes Mocho Blog theme <= 1.0.4 versions. | |
| Modificada | Media (6.1) | 0.41% | — | Cththemes Balkon | 25/7/2023 | 17/6/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <= 1.3.2 versions. | |
| Modificada | Alta (7.5) | 0.76% | — | Leothemes AP Page Builder | 18/7/2023 | 17/6/2026 | Ap Page Builder, in versions lower than 1.7.8.2, could allow a remote attacker to send a specially crafted SQL query to the product_one_img parameter to retrieve the information stored in the database. | |
| Modificada | Media (6.1) | 0.59% | — | Deothemes AmelaDeothemes ArendelleDeothemes EverseDeothemes Medikaid+1 | 18/7/2023 | 17/6/2026 | Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully… | |
| Modificada | Alta (8.8) | 0.26% | — | Hasthemes Woolentor - Woocommerce Elementor Addons + Builder | 17/7/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.6.2 versions. | |
| Modificada | Alta (8.8) | 0.26% | — | Vibethemes Vslider | 17/7/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions. | |
| Analizada | Alta (8.8) | 0.30% | — | Vibethemes Wordpress Learning Management System | 11/7/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <= 4.900 versions. | |
| Modificada | Alta (8.8) | 0.26% | — | Hasthemes Wishsuite | 11/7/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in HasTheme WishSuite plugin <= 1.3.3 versions. | |
| Modificada | Alta (8.8) | 0.26% | — | Hasthemes Justtables | 11/7/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes JustTables plugin <= 1.4.9 versions. | |
| Modificada | Alta (8.8) | 0.26% | — | Hasthemes HT Menu | 11/7/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Menu plugin <= 1.2.1 versions. | |
| Modificada | Alta (8.8) | 0.26% | — | Hasthemes Swatchly | 11/7/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Swatchly plugin <= 1.2.0 versions. | |
| Modificada | Alta (8.8) | 0.32% | — | Hasthemes HT Feed | 10/7/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Feed plugin <= 1.2.7 versions. | |
| Modificada | Crítica (9.8) | 1.9% | — | Stylemixthemes Bookit | 30/6/2023 | 17/6/2026 | The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on… | |
| Modificada | Media (4.8) | 0.37% | — | Fancythemes Optin Forms | 26/6/2023 | 17/6/2026 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for WordPress plugin <= 1.3.1 versions. | |
| Modificada | Media (6.1) | 0.38% | — | Cththemes Theroof | 26/6/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CTHthemes TheRoof theme <= 1.0.3 versions. | |
| Modificada | Media (6.5) | 0.56% | — | Stylemixthemes Masterstudy LMS | 22/6/2023 | 17/6/2026 | Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more. |