Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2975▼ 108 respecto a la semana anterior
Críticas / altas1449▲ 87 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)350▼ 160 respecto a la semana anterior
11 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Alta (7.2) | 0.27% | — | Wp-buy Visitor Traffic Real Time StatisticsAI | 3/10/2026 | 6/10/2026 | The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… | |
| Aplazada | Alta (7.1) | 0.25% | — | Visitor Traffic Real Time Statistics PROAI | 17/9/2026 | 17/9/2026 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions. | |
| Aplazada | Crítica (9.3) | 0.40% | — | Visitor Traffic Real Time Statistics PROAI | 27/8/2026 | 28/8/2026 | Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions. | |
| Aplazada | Alta (8.5) | 0.36% | — | Visitor Traffic Real Time Statistics PROAI | 13/8/2026 | 14/8/2026 | Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions. | |
| Aplazada | Alta (7.1) | 0.25% | — | Visitor Traffic Real Time Statistics PROAI | 13/8/2026 | 14/8/2026 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions. | |
| Aplazada | Alta (7.1) | 0.25% | — | Visitor Traffic Real Time Statistics PROAI | 23/7/2026 | 23/7/2026 | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions. | |
| Aplazada | Alta (7.2) | 0.32% | — | Wp-buy Visitor Traffic Real Time StatisticsAI | 4/4/2026 | 24/7/2026 | The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web… | |
| Modificada | Alta (8.8) | 1.4% | — | Wp-buy Visitor Traffic Real Time Statistics | 8/11/2021 | 17/6/2026 | The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue | |
| Modificada | Alta (8.8) | 1.3% | — | Wp-buy Visitor Traffic Real Time Statistics | 14/5/2021 | 17/6/2026 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers… | |
| Modificada | Alta (8.8) | 0.80% | — | Wp-buy Visitor Traffic Real Time Statistics | 30/8/2019 | 17/6/2026 | The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. | |
| Modificada | Alta (8.8) | 0.74% | — | Wp-buy Visitor Traffic Real Time Statistics | 30/8/2019 | 17/6/2026 | The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. |