Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2797▼ 203 respecto a la semana anterior

Críticas / altas1352▲ 28 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)255▼ 266 respecto a la semana anterior

9 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-58705	Aplazada	Alta (8.1)	0.41%	—	Axiomthemes Crafti^AI	2/6/2026	22/7/2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local File Inclusion. This issue affects Crafti: from n/a through 1.12.
CVE-2026-28021	Aplazada	Alta (8.1)	0.58%	—	Themerex Craftis^AI	5/3/2026	17/6/2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Craftis craftis allows PHP Local File Inclusion.This issue affects Craftis: from n/a through <= 1.2.8.
CVE-2023-48335	Aplazada	Baja (3.7)	0.30%	—	Webcraftic Hide Login Page^AI	4/6/2024	17/6/2026	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Webcraftic Hide login page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hide login page: from n/a through 1.1.9.
CVE-2015-9469	Modificada	Media (4.8)	0.95%	—	Cybercraftit Content-grabber	10/10/2019	17/6/2026	The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id.
CVE-2019-16289	Modificada	Media (5.4)	1.0%	—	Webcraftic Woody AD Snippets	13/9/2019	17/6/2026	The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.
CVE-2019-15858	Modificada	Alta (8.8)	18%	—	Webcraftic Woody AD Snippets	3/9/2019	17/6/2026	admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
CVE-2019-15818	Modificada	Media (6.1)	1.5%	—	Webcraftic Simple 301 Redirects	30/8/2019	17/6/2026	The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
CVE-2019-15776	Modificada	Media (6.1)	1.3%	—	Webcraftic Simple 301 Redirects-addon-bulk Uploader	29/8/2019	17/6/2026	The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.
CVE-2019-14773	Modificada	Alta (7.5)	1.6%	—	Webcraftic Woody AD Snippets	8/8/2019	17/6/2026	admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.