Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2731▲ 24 respecto a la semana anterior

Críticas / altas1467▲ 357 respecto a la semana anterior

Nueva explotación activa (KEV)7▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)68▼ 458 respecto a la semana anterior

6 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-1060	Aplazada	Media (5.3)	0.29%	—	Wpadminify WP Adminify^AI	28/1/2026	17/6/2026	The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permission_callback set to __return_true, allowing unauthenticated attackers to retrieve the…
CVE-2025-68593	Aplazada	Media (5.4)	0.25%	—	Wpadminify WP Adminify^AI	24/12/2025	17/6/2026	Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
CVE-2025-68592	Aplazada	Media (4.3)	0.23%	—	Wpadminify WP Adminify^AI	24/12/2025	17/6/2026	Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
CVE-2023-52132	Modificada	Alta (7.2)	0.54%	—	Wpadminify WP Adminify	31/12/2023	17/6/2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6.
CVE-2023-44266	Modificada	Media (4.8)	0.34%	—	Wpadminify WP Adminify	2/10/2023	17/6/2026	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jewel Theme WP Adminify plugin <= 3.1.6 versions.
CVE-2023-4060	Modificada	Media (4.8)	0.47%	—	Wpadminify WP Adminify	11/9/2023	17/6/2026	The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)