Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2531▼ 362 respecto a la semana anterior

Críticas / altas1340▲ 76 respecto a la semana anterior

Nueva explotación activa (KEV)6▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior

11 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-54018	Aplazada	Media (4.3)	0.21%	—	Creativemindssolutions CM Pop-up Banners^AI	16/7/2025	17/6/2026	Missing Authorization vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Pop-Up banners: from n/a through <= 1.8.4.
CVE-2025-31432	Aplazada	Alta (7.5)	0.60%	—	Chop Chop Pop-up^AI	28/3/2025	17/6/2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Chop Chop Pop-Up Chop Chop pop-up allows PHP Local File Inclusion.This issue affects Pop-Up Chop Chop: from n/a through <= 2.1.7.
CVE-2025-24694	Aplazada	Alta (7.1)	0.39%	—	Creativemindssolutions CM Pop-up Banners^AI	3/3/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Reflected XSS.This issue affects CM Pop-Up banners: from n/a through <= 1.7.6.
CVE-2024-38744	Aplazada	Alta (8.3)	0.34%	—	Upqode Plum Spin Wheel AND Email Pop-up^AI	1/11/2024	17/6/2026	Missing Authorization vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS.This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0.
CVE-2024-38743	Aplazada	Media (5.3)	0.40%	—	Upqode Plum Spin Wheel AND Email Pop-up^AI	1/11/2024	17/6/2026	Access Control vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows . This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0.
CVE-2023-3977	Modificada	Media (4.3)	0.61%	—	Backupbliss Backup Migration Backupbliss Clone Copy-delete-posts Duplicate Post Inisev Enhanced Text Widget+6	28/7/2023	17/6/2026	Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers…
CVE-2023-0958	Modificada	Media (6.5)	0.69%	—	Backupbliss Backup Migration Backupbliss Clone Copy-delete-posts Duplicate Post Inisev Enhanced Text Widget+7	28/7/2023	17/6/2026	Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions,…
CVE-2022-43480	Modificada	Media (4.8)	0.39%	—	Magneticlab Homepage Pop-up	16/4/2023	17/6/2026	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.
CVE-2022-44585	Modificada	Alta (8.8)	0.26%	—	Magneticlab Homepage Pop-up	2/2/2023	17/6/2026	Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.
CVE-2022-41638	Modificada	Media (5.4)	0.46%	—	Chop-chop Pop-up Chop Chop	21/10/2022	17/6/2026	Auth. Stored Cross-Site Scripting (XSS) in Pop-Up Chop Chop plugin <= 2.1.7 on WordPress.
CVE-2022-38070	Modificada	Alta (8.8)	0.98%	—	Mypopups Pop-up	9/9/2022	17/6/2026	Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress.