Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2980▼ 83 respecto a la semana anterior

Críticas / altas1452▲ 101 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)353▼ 157 respecto a la semana anterior

14 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-68523	Aplazada	Media (4.3)	0.19%	—	Spiffyplugins Spiffy Calendar^AI	24/12/2025	17/6/2026	Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spiffy Calendar: from n/a through <= 5.0.7.
CVE-2024-43969	Aplazada	Alta (7.6)	0.42%	—	Spiffyplugins Spiffy Calendar^AI	17/9/2024	17/6/2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.12.
CVE-2024-45458	Modificada	Media (6.1)	0.31%	—	Spiffyplugins Spiffy Calendar	15/9/2024	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
CVE-2024-45457	Modificada	Media (5.4)	0.26%	—	Spiffyplugins Spiffy Calendar	15/9/2024	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.
CVE-2024-38692	Modificada	Alta (7.2)	0.72%	—	Spiffyplugins Spiffy Calendar	22/7/2024	17/6/2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.11.
CVE-2024-30528	Modificada	Media (6.3)	0.28%	—	Spiffyplugins Spiffy Calendar	4/6/2024	17/6/2026	Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10.
CVE-2024-30427	Modificada	Media (6.1)	0.41%	—	Spiffyplugins Spiffy Calendar	29/3/2024	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through 4.9.7.
CVE-2024-0855	Analizada	Media (5.3)	0.48%	—	Spiffyplugins Spiffy Calendar	27/2/2024	17/6/2026	The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.
CVE-2023-49745	Modificada	Media (5.4)	0.41%	—	Spiffyplugins Spiffy Calendar	14/12/2023	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through 4.9.5.
CVE-2022-46859	Modificada	Crítica (9.8)	0.55%	—	Spiffyplugins Spiffy Calendar	3/11/2023	17/6/2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.1.
CVE-2023-32122	Modificada	Media (6.1)	0.34%	—	Spiffyplugins Spiffy Calendar	18/8/2023	17/6/2026	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spiffy Plugins Spiffy Calendar plugin <= 4.9.3 versions.
CVE-2022-29434	Modificada	Media (5.4)	0.70%	—	Spiffyplugins Spiffy Calendar	20/5/2022	17/6/2026	Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.
CVE-2022-25599	Modificada	Media (4.3)	0.40%	—	Spiffyplugins Spiffy Calendar	21/2/2022	17/6/2026	Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).
CVE-2017-9420	Modificada	Media (6.1)	1.3%	—	Sunnythemes Spiffy Calendar	5/6/2017	17/6/2026	Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.