Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2610▼ 308 respecto a la semana anterior
Críticas / altas1345▲ 79 respecto a la semana anterior
Nueva explotación activa (KEV)6▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)62▼ 465 respecto a la semana anterior
6 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Alta (7.1) | 0.25% | — | AffiliatewpAI | 6/8/2026 | 12/8/2026 | Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions. | |
| Aplazada | Alta (7.1) | 0.25% | — | AffiliatewpAI | 23/7/2026 | 23/7/2026 | Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions. | |
| Aplazada | Crítica (9.8) | 0.48% | — | Affiliatewp RewardswpAI | 25/3/2026 | 17/6/2026 | Incorrect Privilege Assignment vulnerability in Andrew Munro / AffiliateWP RewardsWP rewardswp allows Privilege Escalation.This issue affects RewardsWP: from n/a through <= 1.0.4. | |
| Aplazada | Alta (7.5) | 0.36% | — | AffiliatewpAI | 30/9/2025 | 17/6/2026 | The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajax_get_affiliate_id_from_login function in all versions up to, and including, 2.28.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for… | |
| Aplazada | Media (5.9) | 0.30% | — | Syedbalkhi Affiliatewp External Referral LinksAI | 22/9/2025 | 1/10/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi AffiliateWP – External Referral Links affiliatewp-external-referral-links allows Stored XSS.This issue affects AffiliateWP – External Referral Links: from n/a through <= 1.2.0. | |
| Modificada | Media (4.3) | 0.39% | — | Affiliatewp | 30/8/2023 | 17/6/2026 | The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_addons_page_plugin' function called via an AJAX action in versions up to, and including, 2.14.0. This makes it possible for authenticated attackers, with subscriber-level access and… |