Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2855▼ 166 respecto a la semana anterior

Críticas / altas1379▲ 45 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)266▼ 260 respecto a la semana anterior

34 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-27983	Aplazada	Crítica (9.8)	0.50%	—	Designthemes LMS Elementor PRO^AI	5/3/2026	17/6/2026	Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor Pro: from n/a through <= 1.0.4.
CVE-2026-27390	Aplazada	Alta (8.8)	0.58%	—	Designthemes Wedesigntech Ultimate Booking Addon^AI	5/3/2026	17/6/2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.
CVE-2026-27389	Aplazada	Crítica (9.8)	0.67%	—	Designthemes Wedesigntech Ultimate Booking Addon^AI	5/3/2026	17/6/2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.
CVE-2026-27386	Aplazada	Alta (7.5)	0.36%	—	Designthemes Directory Addon^AI	5/3/2026	17/6/2026	Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Directory Addon: from n/a through <= 1.8.
CVE-2026-27385	Aplazada	Alta (7.1)	0.26%	—	Designthemes Portfolio^AI	5/3/2026	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfolio: from n/a through <= 1.3.
CVE-2026-22473	Aplazada	Alta (8.8)	0.38%	—	Designthemes Dental Clinic^AI	5/3/2026	17/6/2026	Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through <= 3.7.
CVE-2025-69302	Aplazada	Alta (7.1)	0.19%	—	Designthemes Core Features^AI	20/2/2026	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through <= 2.3.
CVE-2025-69095	Aplazada	Media (6.5)	0.28%	—	Designthemes Dt-reservation-plugin^AI	22/1/2026	17/6/2026	Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.
CVE-2025-69002	Aplazada	Alta (8.8)	0.41%	—	Designthemes Onelife^AI	22/1/2026	17/6/2026	Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.
CVE-2025-68899	Aplazada	Alta (8.8)	0.47%	—	Designthemes Vivagh^AI	22/1/2026	17/6/2026	Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4.
CVE-2025-67619	Aplazada	Alta (8.8)	0.64%	—	Designthemes Kids Heaven^AI	22/1/2026	17/6/2026	Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2.
CVE-2025-68982	Aplazada	Media (5.3)	0.25%	—	Designthemes LMS Addon^AI	30/12/2025	17/6/2026	Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/a through <= 2.6.
CVE-2025-68981	Aplazada	Media (5.3)	0.25%	—	Designthemes Homefix Elementor Portfolio^AI	30/12/2025	17/6/2026	Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.
CVE-2025-68980	Aplazada	Media (5.3)	0.25%	—	Designthemes Wedesigntech Portfolio^AI	30/12/2025	17/6/2026	Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.
CVE-2025-68978	Aplazada	Media (6.5)	0.20%	—	Designthemes Core^AI	30/12/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows DOM-Based XSS.This issue affects DesignThemes Core: from n/a through <= 1.6.
CVE-2025-68977	Aplazada	Media (6.5)	0.19%	—	Designthemes Portfolio Addon^AI	30/12/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through <= 1.5.
CVE-2025-64221	Aplazada	Alta (7.1)	0.22%	—	Designthemes Dt-reservation-plugin^AI	18/12/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Reflected XSS.This issue affects Reservation Plugin: from n/a through <= 1.6.
CVE-2025-13542	Aplazada	Crítica (9.8)	0.37%	—	Designthemes LMS^AI	2/12/2025	17/6/2026	The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the…
CVE-2025-60234	Aplazada	Alta (8.8)	0.53%	—	Designthemes Single Property^AI	22/10/2025	17/6/2026	Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: from n/a through <= 2.8.
CVE-2025-60228	Aplazada	Alta (8.8)	0.53%	—	Designthemes Knowledge Base^AI	22/10/2025	17/6/2026	Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a through <= 2.9.
CVE-2025-60215	Aplazada	Alta (8.8)	0.53%	—	Designthemes Kriya^AI	22/10/2025	17/6/2026	Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4.
CVE-2025-53423	Aplazada	Alta (7.1)	0.25%	—	Designthemes Triss^AI	22/10/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Triss triss allows Reflected XSS.This issue affects Triss: from n/a through <= 2.6.
CVE-2025-32283	Aplazada	Alta (8.8)	0.61%	—	Designthemes Solar Energy^AI	22/10/2025	17/6/2026	Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5.
CVE-2025-31427	Aplazada	Alta (7.1)	0.24%	—	Designthemes Invico^AI	16/7/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Invico - WordPress Consulting Business Theme invico allows Reflected XSS.This issue affects Invico - WordPress Consulting Business Theme: from n/a through <= 1.9.
CVE-2025-31422	Aplazada	Alta (8.8)	0.46%	—	Designthemes Visual ART Gallery^AI	16/7/2025	17/6/2026	Deserialization of Untrusted Data vulnerability in designthemes Visual Art \| Gallery WordPress Theme visual-arts allows Object Injection.This issue affects Visual Art \| Gallery WordPress Theme: from n/a through <= 2.4.