Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2523▼ 417 respecto a la semana anterior

Críticas / altas1297▲ 13 respecto a la semana anterior

Nueva explotación activa (KEV)6▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)60▼ 468 respecto a la semana anterior

10 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-92994	Aplazada	Alta (8.8)	0.28%	—	Verge3d Publishing AND E Commerce^AI	30/9/2026	30/9/2026	The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the…
CVE-2026-92996	Aplazada	Media (5.3)	0.11%	—	Soft8soft Verge3d^AI	28/9/2026	28/9/2026	The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
CVE-2026-92995	Aplazada	Media (5.3)	0.21%	—	Verge3d Publishing AND E Commerce^AI	27/9/2026	28/9/2026	The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization.
CVE-2025-49268	Aplazada	Media (5.3)	0.34%	—	Soft8soft Verge3d^AI	6/6/2025	17/6/2026	Missing Authorization vulnerability in Soft8Soft LLC Verge3D verge3d allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verge3D: from n/a through <= 4.9.4.
CVE-2025-48241	Aplazada	Alta (7.1)	0.22%	—	Soft8soft Verge3d^AI	23/5/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.9.3.
CVE-2025-39443	Aplazada	Media (4.3)	0.17%	—	Soft8soft Verge3d^AI	17/4/2025	17/6/2026	Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through <= 4.9.0.
CVE-2025-30833	Aplazada	Media (4.3)	0.21%	—	Soft8soft Verge3d^AI	27/3/2025	17/6/2026	Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through <= 4.8.2.
CVE-2025-22709	Aplazada	Alta (7.1)	0.26%	—	Soft8soft Verge3d^AI	21/1/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.8.0.
CVE-2023-51421	Modificada	Alta (8.8)	0.59%	—	Soft8soft Verge3d	29/12/2023	17/6/2026	Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.
CVE-2023-51420	Modificada	Alta (8.8)	0.58%	—	Soft8soft Verge3d	29/12/2023	17/6/2026	Improper Control of Generation of Code ('Code Injection') vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.