Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2614▼ 473 respecto a la semana anterior

Críticas / altas1270▼ 74 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)243▼ 274 respecto a la semana anterior

11 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-17008	Aplazada	Media (5.3)	0.16%	—	Fullworksplugins Quick Paypal Payments^AI	12/8/2026	26/8/2026	The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.
CVE-2025-14073	Aplazada	Media (5.3)	0.40%	—	Woocommerce Paypal Payments^AI	1/8/2026	29/9/2026	The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the `enqueue_paypal_insights_script_on_order_received()` function due to missing validation on a user controlled key. This…
CVE-2026-9284	Aplazada	Alta (8.2)	0.46%	—	Woocommerce Paypal Payments^AI	23/5/2026	23/7/2026	The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints in all versions up to, and including, 4.0.1. The `ppc-create-order` endpoint accepts an…
CVE-2026-39707	Aplazada	Media (5.3)	0.32%	—	Zealousweb Accept Paypal Payments Using Contact Form 7^AI	8/4/2026	24/7/2026	Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept PayPal Payments using Contact Form 7: from n/a through <= 4.0.4.
CVE-2025-27003	Aplazada	Media (4.3)	0.13%	—	Fullworksplugins Quick Paypal Payments^AI	5/9/2025	17/6/2026	Cross-Site Request Forgery (CSRF) vulnerability in fullworks Quick Paypal Payments quick-paypal-payments allows Cross Site Request Forgery.This issue affects Quick Paypal Payments: from n/a through <= 5.7.46.
CVE-2023-25714	Aplazada	Alta (7.5)	0.76%	—	Fullworksplugins Quick Paypal Payments^AI	9/12/2024	17/6/2026	Missing Authorization vulnerability in Fullworks Quick Paypal Payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 5.7.25.
CVE-2023-35917	Modificada	Alta (8.8)	0.29%	—	Woocommerce Paypal Payments	22/6/2023	17/6/2026	Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions.
CVE-2023-1554	Modificada	Media (4.8)	0.47%	—	Fullworksplugins Quick Paypal Payments	2/5/2023	17/6/2026	The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-23889	Modificada	Media (5.4)	0.36%	—	Fullworksplugins Quick Paypal Payments	25/4/2023	17/6/2026	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
CVE-2023-25713	Modificada	Media (6.1)	0.41%	—	Fullworksplugins Quick Paypal Payments	7/4/2023	17/6/2026	Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
CVE-2023-25702	Modificada	Media (4.8)	0.39%	—	Fullworksplugins Quick Paypal Payments	7/4/2023	17/6/2026	Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.