Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas3187▲ 591 respecto a la semana anterior
Críticas / altas1502▲ 108 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 1 respecto a la semana anterior
Sin puntuar (sin CVSS)241▲ 227 respecto a la semana anterior
3389 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Media (6.1) | 0.38% | — | Imagerecycle PDF & Image Compression | 4/9/2023 | 17/6/2026 | Vulnerabilidad de Cross-Site Scripting (XSS) reflejado no autenticado en el plugin ImageRecycle pdf & image compression en versiones anteriores e incluyendo la 3.1.11. | |
| Modificada | Media (6.1) | 1.0% | 💥 Exploit | Ajaydsouza Connections ReloadedArchimidismertzanos Atlast BusinessArchimidismertzanos Fashionable StoreArchimidismertzanos Nothing Personal+42 | 4/9/2023 | 17/6/2026 | Todo lo anterior: Tema de WordPress de Aapna hasta 1.3, Tema de WordPress de Anand hasta 1.2, Tema de WordPress de Anfaust hasta 1.1, Tema de WordPress de Arendelle antes de 1.1.13, Tema de WordPress de Atlast Business hasta 1.5.8.5, Tema de WordPress de Bazaar Lite antes de 1.8.6, Tema de WordPress de Brain Power… | |
| Modificada | Media (6.1) | 0.38% | — | Imagerecycle PDF & Image Compression | 4/9/2023 | 17/6/2026 | Vulnerabilidad de Cross-Site Scripting (XSS) Reflejada no autenticada en el plugin ImageRecycle pdf & image compression en versiones anteriores e incluyendo la 3.1.10. | |
| Modificada | Media (4.8) | 0.36% | — | Minorange Wordpress Yourmembership Single Sign-on | 1/9/2023 | 17/6/2026 | Autenticación. (admin+) Vulnerabilidad de Stored Cross-Site Scripting (XSS) en miniOrange en el complemento YourMembership Single Sign On – YM SSO Login en la versión 1.1.3 y anteriores. | |
| Modificada | Media (6.1) | 0.46% | — | Iansadowsky Wordpress Tables | 30/8/2023 | 17/6/2026 | Vulnerabilidad de Cross-Site Scripting (XSS) Reflejada en el plugin WordPress Tables de Ian Sadovy, que afecta a las versiones 1.3.9 e inferiores. Para explotar esta vulnerabilidad no hace falta estar autenticado. | |
| Modificada | Media (4.8) | 0.44% | — | Miled Wordpress Social Login | 30/8/2023 | 17/6/2026 | Vulnerabilidad de Cross-Site Scripting (XSS) Almacenada en el plugin WordPress Social Login de Miled que afecta a versiones 3.0.4 e inferiores. Para explotar esta vulnerabilidad hace falta estar autenticado y tener permisos de administrador o superior. | |
| Modificada | Media (6.1) | 0.46% | — | Casier Bbpress Toolkit | 30/8/2023 | 17/6/2026 | Vulnerabilidad de Cross-Site Scripting (XSS) Reflejada en el plugin bbPress Toolkit de Pascal Casier para versiones 1.0.12 e inferiores. Para explotar esta vulnerabilidad no hace falta estar autenticado. | |
| Modificada | Media (6.1) | 0.45% | — | Miled Wordpress Social Login | 30/8/2023 | 17/6/2026 | Vulnerabilidad de Cross-Site Scripting (XSS) Reflejado en el plugin WordPress Social Login de Miled afecta a las versiones 3.0.4 e inferiores. | |
| Modificada | Media (6.1) | 0.38% | — | Chilexpress-oficial | 30/8/2023 | 17/6/2026 | Vulnerabilidad de Cross-Site Scripting (XSS) Reflejada en el plugin Chilexpress woo oficial de Chilexpress que afecta a las versiones 1.2.9 e inferiores. Para explotar esta vulnerabilidad no hace falta estar autenticado. | |
| Modificada | Media (6.1) | 0.21% | — | Pluginus Wolf - Wordpress Posts Bulk Editor AND Products Manager Professional | 18/8/2023 | 17/6/2026 | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.6 versions. | |
| Modificada | Media (4.8) | 0.37% | — | Davidmichaelross Dave's Wordpress Live Search | 17/8/2023 | 17/6/2026 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dave Ross Dave's WordPress Live Search plugin <= 4.8.1 versions. | |
| Modificada | Media (5.3) | 0.55% | — | Cisco Unified Contact Center Express | 16/8/2023 | 17/6/2026 | A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to cause a web cache poisoning attack on an affected device. This vulnerability is due to improper input validation of HTTP requests. An attacker could exploit this… | |
| Modificada | Media (5.4) | 0.34% | — | Blubrry Powerpress | 15/8/2023 | 17/6/2026 | Vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el plugin PowerPress Podcasting de Blubrry que afecta a las versiones 10.0.1 e inferiores del plugin Blubrry. Para explotar esta vulnerabilidad hace falta estar autenticado y tener permisos de colaborador o superior. | |
| Modificada | Media (4.8) | 0.37% | — | Ihomefinder Optima Express + Marketboost IDX | 14/8/2023 | 17/6/2026 | Vulnerabilidad de Cross-Site Scripting (XSS) autenticada (con permisos de admin o superiores) almacenada en el complemento ihomefinder Optima Express + MarketBoost IDX Plugin en versiones <= 7.3.0. | |
| Modificada | Media (5.4) | 0.51% | — | Wpdeveloper Embedpress | 10/8/2023 | 17/6/2026 | The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedpress_calendar' shortcode in versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with… | |
| Modificada | Media (4.3) | 0.52% | — | Wpdeveloper Embedpress | 10/8/2023 | 17/6/2026 | The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or above, to delete… | |
| Modificada | Media (4.8) | 0.34% | — | Anspress | 10/8/2023 | 17/6/2026 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Rahul Aryan AnsPress plugin <= 4.3.0 versions. | |
| Modificada | Media (4.8) | 0.37% | — | Themeqx Letterpress | 8/8/2023 | 17/6/2026 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themeqx LetterPress plugin <= 1.1.2 versions. | |
| Modificada | Media (6.1) | 0.38% | — | I13websolution Wordpress Vertical Image Slider | 8/8/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress vertical image slider plugin <= 1.2.16 versions. | |
| Modificada | Media (5.4) | 0.55% | — | Expresstech Quiz AND Survey Master | 7/8/2023 | 17/6/2026 | The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks | |
| Modificada | Media (6.5) | 0.99% | — | Simonsmith Cypress Image Snapshot | 4/8/2023 | 17/6/2026 | cypress-image-snapshot muestra regresiones visuales en Cypress con jest-image-snapshot. Antes de la versión 8.0.2, era posible que un usuario pasara una ruta de archivo relativa para el nombre de la instantánea y llegara fuera del directorio del proyecto a la máquina que ejecutaba la prueba. Este problema se ha… | |
| Modificada | Media (6.1) | 0.41% | — | Mtrv Teachpress | 25/7/2023 | 17/6/2026 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 9.0.2 versions. | |
| Modificada | Media (5.6) | 0.38% | — | Oracle Application Express | 18/7/2023 | 17/6/2026 | Vulnerability in the Application Express Administration product of Oracle Application Express (component: None). Supported versions that are affected are Application Express Administration: 18.2-22.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise… | |
| Modificada | Crítica (9) | 0.61% | — | Oracle Application Express | 18/7/2023 | 17/6/2026 | Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Customers Plugin: 18.2-22.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise… | |
| Modificada | Crítica (9) | 0.61% | — | Oracle Application Express | 18/7/2023 | 17/6/2026 | Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Team Calendar Plugin: 18.2-22.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to… |