Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2904▼ 176 respecto a la semana anterior

Críticas / altas1294▼ 55 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)487▼ 22 respecto a la semana anterior

10 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-85010	Aplazada	Media (5.3)	0.32%	—	Magnigenie Restropress^AI	21/9/2026	21/9/2026	The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
CVE-2026-85009	Aplazada	Media (6.5)	0.27%	—	Magnigenie Restropress^AI	18/9/2026	18/9/2026	The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
CVE-2025-62129	Aplazada	Media (5.3)	0.22%	—	Magnigenie Restropress^AI	31/12/2025	17/6/2026	Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.7.
CVE-2025-69017	Aplazada	Media (6.5)	0.16%	—	Magnigenie Restropress^AI	30/12/2025	5/10/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through <= 3.2.8.6.
CVE-2025-66100	Aplazada	Media (6.5)	0.24%	—	Magnigenie Restropress^AI	18/12/2025	17/6/2026	Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.3.5.
CVE-2025-9209	Aplazada	Crítica (9.8)	2.3%	—	Magnigenie Restropress^AI	3/10/2025	17/6/2026	The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT…
CVE-2025-32553	Aplazada	Alta (7.1)	0.42%	—	Magnigenie Restropress^AI	11/4/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Reflected XSS.This issue affects RestroPress: from n/a through <= 3.2.8.4.
CVE-2025-31877	Aplazada	Media (4.3)	0.25%	—	Magnigenie Restropress^AI	1/4/2025	17/6/2026	Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.8.
CVE-2024-35719	Modificada	Media (5.4)	0.28%	—	Magnigenie Restropress	8/6/2024	17/6/2026	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagniGenie RestroPress allows Stored XSS.This issue affects RestroPress: from n/a through 3.1.2.1.
CVE-2024-32449	Aplazada	Media (5.4)	0.21%	—	Magnigenie Restropress^AI	15/4/2024	17/6/2026	Cross-Site Request Forgery (CSRF) vulnerability in MagniGenie RestroPress.This issue affects RestroPress: from n/a through 3.1.2.