7.1Alta

CVE-2026-66440WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability

XplodedThemes WPIDE – File Manager & Code Editor Publicada: 2026-08-06 17:27 (hace 3 meses)

Descripción

Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.

Debilidad (CWE): CWE-79

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
XplodedThemes	WPIDE – File Manager & Code Editor	≤ 3.5.7

Referencias y parches

https://patchstack.com/database/wordpress/plugin/wpide/vulnerability/wordpress-wpide-file-manager-code-editor… vdb-entry

Puntuación CVSS

7.1Alta

Fuente: Patchstack · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Requerida
Alcance: Cambiado
Confidencialidad: Bajo
Integridad: Bajo
Disponibilidad: Bajo

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Todas las puntuaciones (2)

cna	CVSS 3.1	7.1Alta
audit@patchstack.com	CVSS 3.1	7.1Alta

EPSS (probabilidad de explotación en 30 días)

0.25%

superior al 17 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2026-07-27
Publicada2026-08-06 17:27
Llegó a IP-DB2026-10-24 23:50
Última actualización2026-10-24 19:10

Asignada por (CNA): Patchstack
Estado en NVD: Deferred

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — WordPress plugins & themes

Sin puntuación

CVE-2026-126639 hace 2 horas

WP Ultimate CSV Importer (Free & Pro) - Unauthenticated Post Data Disclosure via Predictable Single Export Path

WP Ultimate CSV Importer; WP Ultimate CSV Importer Pro

The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name…

Sin puntuación

CVE-2026-126640 hace 2 horas

WP Ultimate CSV Importer < 9.3 - Admin+ SQLi via LifterLMS Import

WP Ultimate CSV Importer

The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site o…

Sin puntuación

CVE-2026-126697 hace 2 horas

Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel

Quick Page/Post Redirect Plugin

The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 updates from its author's own server instead of WordPress.org, which wa…

Sin puntuación

CVE-2026-118182 hace 2 horas

Copy & Delete Posts < 1.5.8 - Authenticated Arbitrary Post Slug Takeover

Duplicate Post

The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5…

Sin puntuación

CVE-2026-118183 hace 2 horas

Copy & Delete Posts < 1.5.8 - Authenticated Post Publishing Restriction Bypass

Duplicate Post

The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one, allowing users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributors, to create …

Sin puntuación

CVE-2026-119258 hace 2 horas

Swipe <= 1.4 - Unauthenticated Authentication Bypass

Swipe

The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated attackers to log in as an existing user, including an administrator, when that user has an active app session.