Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2623▼ 306 respecto a la semana anterior
Críticas / altas1347▲ 75 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)64▼ 463 respecto a la semana anterior
6 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Media (4.9) | 0.56% | — | Sslzen SSL ZENAI | 25/9/2026 | 25/9/2026 | The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents… | |
| Aplazada | Media (6.1) | 0.27% | — | Sslzen SSL ZENAI | 25/9/2026 | 25/9/2026 | The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42. The ssl_zen_messages::getMessages() function builds the 'token_missmatch' message using base64_decode(sanitize_text_field($_REQUEST['uri'])) and (optionally)… | |
| Aplazada | Media (6.1) | 0.14% | — | Sslzen SSL ZENAI | 19/9/2026 | 21/9/2026 | The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… | |
| Aplazada | Media (5.3) | 0.18% | — | Sslzen SSL ZENAI | 11/9/2026 | 11/9/2026 | The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS… | |
| Aplazada | Alta (7.1) | 0.25% | — | Sslzen SSL ZENAI | 18/8/2026 | 20/8/2026 | Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions. | |
| Analizada | Media (6.5) | 0.41% | — | Sslzen SSL ZEN | 8/5/2024 | 17/6/2026 | The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who doesn't support… |