{"id":3171,"date":"2024-03-12T09:45:24","date_gmt":"2024-03-12T09:45:24","guid":{"rendered":"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/"},"modified":"2024-03-12T09:45:24","modified_gmt":"2024-03-12T09:45:24","slug":"vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion","status":"publish","type":"post","link":"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/","title":{"rendered":"Vulnerabilidad de Cross-Site Scripting en weForms &lt;= 1.6.21 a trav\u00e9s del Referer sin autenticaci\u00f3n"},"content":{"rendered":"<div>La vulnerabilidad CVE-2024-0386 en el plugin weForms para WordPress permite a atacantes no autenticados inyectar scripts web arbitrarios en las p\u00e1ginas, lo que puede poner en riesgo la seguridad de los usuarios.<\/div>\n<p><\/p>\n<div>La vulnerabilidad de Cross-Site Scripting (XSS) almacenada en weForms hasta la versi\u00f3n 1.6.21 se debe a una insuficiente sanitizaci\u00f3n de entrada y escape de salida en el encabezado HTTP &#8216;Referer&#8217;. Esto significa que un atacante puede insertar scripts maliciosos que se ejecutar\u00e1n cuando un usuario acceda a una p\u00e1gina comprometida. Para mitigar este riesgo, los usuarios de weForms deben actualizar el plugin a la \u00faltima versi\u00f3n disponible,  realizar una validaci\u00f3n adecuada de los datos de entrada en sus formularios y utilizar opciones de seguridad adicionales como firewalls de aplicaciones web para protegerse contra posibles amenazas de seguridad.<\/div>\n<div>Es crucial para los usuarios de WordPress mantener sus plugins actualizados y tomar medidas proactivas para garantizar la seguridad de sus sitios web. La vulnerabilidad de XSS en weForms es un recordatorio de la importancia de implementar buenas pr\u00e1cticas de seguridad en l\u00ednea para protegerse contra posibles ataques cibern\u00e9ticos.<\/div>\n","protected":false},"excerpt":{"rendered":"<p>La vulnerabilidad CVE-2024-0386 en el plugin weForms para WordPress permite a atacantes no autenticados inyectar scripts web arbitrarios en las p\u00e1ginas, lo que puede poner en riesgo la seguridad de los usuarios. La vulnerabilidad de Cross-Site Scripting (XSS) almacenada en weForms hasta la versi\u00f3n 1.6.21 se debe a una insuficiente sanitizaci\u00f3n de entrada y escape [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[884],"class_list":["post-3171","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cve-2024-0386"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.8 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Vulnerabilidad de Cross-Site Scripting en weForms &lt;= 1.6.21 a trav\u00e9s del Referer sin autenticaci\u00f3n - SeguridadWordPress.es<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Vulnerabilidad de Cross-Site Scripting en weForms &lt;= 1.6.21 a trav\u00e9s del Referer sin autenticaci\u00f3n - SeguridadWordPress.es\" \/>\n<meta property=\"og:description\" content=\"La vulnerabilidad CVE-2024-0386 en el plugin weForms para WordPress permite a atacantes no autenticados inyectar scripts web arbitrarios en las p\u00e1ginas, lo que puede poner en riesgo la seguridad de los usuarios. La vulnerabilidad de Cross-Site Scripting (XSS) almacenada en weForms hasta la versi\u00f3n 1.6.21 se debe a una insuficiente sanitizaci\u00f3n de entrada y escape [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/\" \/>\n<meta property=\"og:site_name\" content=\"SeguridadWordPress.es\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-12T09:45:24+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/\",\"url\":\"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/\",\"name\":\"Vulnerabilidad de Cross-Site Scripting en weForms &lt;= 1.6.21 a trav\u00e9s del Referer sin autenticaci\u00f3n - SeguridadWordPress.es\",\"isPartOf\":{\"@id\":\"http:\/\/127.0.0.1\/#website\"},\"datePublished\":\"2024-03-12T09:45:24+00:00\",\"dateModified\":\"2024-03-12T09:45:24+00:00\",\"author\":{\"@id\":\"\"},\"breadcrumb\":{\"@id\":\"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\/\/127.0.0.1\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Vulnerabilidad de Cross-Site Scripting en weForms &lt;= 1.6.21 a trav\u00e9s del Referer sin autenticaci\u00f3n\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/127.0.0.1\/#website\",\"url\":\"http:\/\/127.0.0.1\/\",\"name\":\"SeguridadWordPress.es\",\"description\":\"Recopilaci\u00f3n de vulnerabilidades WordPress.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/127.0.0.1\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Vulnerabilidad de Cross-Site Scripting en weForms &lt;= 1.6.21 a trav\u00e9s del Referer sin autenticaci\u00f3n - SeguridadWordPress.es","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/","og_locale":"en_US","og_type":"article","og_title":"Vulnerabilidad de Cross-Site Scripting en weForms &lt;= 1.6.21 a trav\u00e9s del Referer sin autenticaci\u00f3n - SeguridadWordPress.es","og_description":"La vulnerabilidad CVE-2024-0386 en el plugin weForms para WordPress permite a atacantes no autenticados inyectar scripts web arbitrarios en las p\u00e1ginas, lo que puede poner en riesgo la seguridad de los usuarios. La vulnerabilidad de Cross-Site Scripting (XSS) almacenada en weForms hasta la versi\u00f3n 1.6.21 se debe a una insuficiente sanitizaci\u00f3n de entrada y escape [&hellip;]","og_url":"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/","og_site_name":"SeguridadWordPress.es","article_published_time":"2024-03-12T09:45:24+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/","url":"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/","name":"Vulnerabilidad de Cross-Site Scripting en weForms &lt;= 1.6.21 a trav\u00e9s del Referer sin autenticaci\u00f3n - SeguridadWordPress.es","isPartOf":{"@id":"http:\/\/127.0.0.1\/#website"},"datePublished":"2024-03-12T09:45:24+00:00","dateModified":"2024-03-12T09:45:24+00:00","author":{"@id":""},"breadcrumb":{"@id":"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/127.0.0.1\/vulnerabilidad-de-cross-site-scripting-en-weforms-1-6-21-a-traves-del-referer-sin-autenticacion\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/127.0.0.1\/"},{"@type":"ListItem","position":2,"name":"Vulnerabilidad de Cross-Site Scripting en weForms &lt;= 1.6.21 a trav\u00e9s del Referer sin autenticaci\u00f3n"}]},{"@type":"WebSite","@id":"http:\/\/127.0.0.1\/#website","url":"http:\/\/127.0.0.1\/","name":"SeguridadWordPress.es","description":"Recopilaci\u00f3n de vulnerabilidades WordPress.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/127.0.0.1\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}},"amp_enabled":true,"_links":{"self":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/3171"}],"collection":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/comments?post=3171"}],"version-history":[{"count":0,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/3171\/revisions"}],"wp:attachment":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/media?parent=3171"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/categories?post=3171"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/tags?post=3171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}