Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2797▼ 203 respecto a la semana anterior

Críticas / altas1352▲ 28 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)255▼ 266 respecto a la semana anterior

4 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-90974	Aplazada	Media (6.5)	0.20%	—	Wpfusion WP Fusion Lite^AI	1/10/2026	1/10/2026	The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.
CVE-2026-90972	Aplazada	Media (5.4)	0.14%	—	WP Fusion Lite^AI	1/10/2026	1/10/2026	The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.
CVE-2024-32796	Aplazada	Media (4.3)	0.53%	—	Jack Arturo WP Fusion Lite^AI	24/4/2024	17/6/2026	Insertion of Sensitive Information Into Sent Data vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite allows Retrieve Embedded Sensitive Data.This issue affects WP Fusion Lite: from n/a through <= 3.42.10.
CVE-2024-27972	Aplazada	Crítica (9.9)	1.6%	—	Jack Arturo WP Fusion Lite^AI	3/4/2024	17/6/2026	Improper Control of Generation of Code ('Code Injection') vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite.This issue affects WP Fusion Lite: from n/a through <= 3.41.24.