Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2768▼ 546 respecto a la semana anterior
Críticas / altas1325▼ 174 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)268▼ 241 respecto a la semana anterior
6 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Alta (7.1) | 0.25% | — | Social Slider FeedAI | 15/6/2026 | 17/6/2026 | Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions. | |
| Analizada | Media (4.8) | 0.31% | — | Cm-wp Social Slider Widget | 15/5/2025 | 17/6/2026 | The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |
| Analizada | Baja (3.5) | 0.26% | — | Cm-wp Social Slider Widget | 25/3/2025 | 17/6/2026 | To exploit the vulnerability, it is necessary: | |
| Aplazada | Media (4.3) | 0.39% | — | Creativemotion Social Slider FeedAI | 1/11/2024 | 17/6/2026 | Missing Authorization vulnerability in creativemotion Social Slider Feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Slider Feed: from n/a through 2.2.2. | |
| Modificada | Media (5.4) | 0.68% | — | Cm-wp Social Slider Widget | 5/4/2021 | 17/6/2026 | The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized | |
| Modificada | Alta (7.5) | 2.9% | 💥 Exploit | Social Slider Project Social Slider | 1/1/2015 | 16/6/2026 | SQL injection vulnerability in social-slider-2/ajax.php in the Social Slider plugin before 7.4.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the rA array parameter. |