Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2952▲ 19 respecto a la semana anterior
Críticas / altas1451▲ 188 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)272▼ 254 respecto a la semana anterior
5 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Recibida | Media (5.3) | 0.19% | — | Userprivatefiles User Private FilesAI | 4/10/2026 | 5/10/2026 | The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly. | |
| Aplazada | Media (6.4) | 0.23% | — | File Sharing Download Manager User Private FilesAI | 16/6/2026 | 17/6/2026 | The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… | |
| Aplazada | Media (6.4) | 0.33% | — | Userprivatefiles User Private FilesAI | 19/2/2025 | 17/6/2026 | The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘new-fldr-name’ parameter in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes it possible for… | |
| Analizada | Media (6.5) | 0.31% | — | Mediajedi User Private Files | 22/8/2024 | 17/6/2026 | The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpk_upvf_update_doc' due to missing validation on the 'docid' user controlled key. This makes it possible for authenticated attackers, with… | |
| Modificada | Alta (8.8) | 1.0% | — | Mediajedi User Private Files | 8/8/2022 | 23/6/2026 | The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded. |