Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas3027▼ 69 respecto a la semana anterior

Críticas / altas1424▲ 58 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)382▼ 128 respecto a la semana anterior

8 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-52726	Aplazada	Alta (8.6)	0.29%	—	Pebas Couponxxl Custom Post Types^AI	27/6/2025	17/6/2026	Incorrect Privilege Assignment vulnerability in pebas CouponXxL Custom Post Types couponxxl-cpt allows Privilege Escalation.This issue affects CouponXxL Custom Post Types: from n/a through <= 3.0.
CVE-2024-10143	Analizada	Media (4.8)	0.31%	—	Deluxeblogtips MB Custom Post Types & Custom Taxonomies	15/5/2025	17/6/2026	The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2025-22748	Aplazada	Media (6.5)	0.28%	—	Setmore Theme Custom Post Types^AI	15/1/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Setmore SetMore Theme – Custom Post Types service-provider-profile-cpt allows Stored XSS.This issue affects SetMore Theme – Custom Post Types: from n/a through <= 1.1.
CVE-2023-6993	Aplazada	Media (6.4)	0.43%	—	Metabox Custom Post Types Custom Fields More^AI	9/4/2024	17/6/2026	The Custom post types, Custom Fields & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and custom post meta in all versions up to, and including, 5.0.4 due to insufficient input sanitization and output escaping on user supplied post meta values. This makes it possible…
CVE-2023-22674	Modificada	Alta (8.8)	0.26%	—	Halgatewood Dashicons + Custom Post Types	21/12/2023	17/6/2026	Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Hal Gatewood Dashicons + Custom Post Types.This issue affects Dashicons + Custom Post Types: from n/a through 1.0.2.
CVE-2023-46781	Modificada	Alta (8.8)	0.21%	—	Rolandmurg Current Menu Item FOR Custom Post Types	6/11/2023	17/6/2026	Cross-Site Request Forgery (CSRF) vulnerability in Roland Murg Current Menu Item for Custom Post Types plugin <= 1.5 versions.
CVE-2023-32116	Modificada	Media (4.8)	0.32%	—	Totalpress Custom Post Types	26/10/2023	17/6/2026	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin <= 4.0.12 versions.
CVE-2022-4442	Modificada	Media (4.8)	0.47%	—	Cozmoslabs Custom Post Types AND Custom Fields Creator	16/1/2023	17/6/2026	The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).