{"id":3394,"date":"2024-03-30T00:45:13","date_gmt":"2024-03-30T00:45:13","guid":{"rendered":"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/"},"modified":"2024-03-30T00:45:13","modified_gmt":"2024-03-30T00:45:13","slug":"forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos","status":"publish","type":"post","link":"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/","title":{"rendered":"Forminator &lt;= 1.29.0 &#8211; Cross-Site Scripting no Autenticado a trav\u00e9s de la Subida de Archivos"},"content":{"rendered":"<div>La vulnerabilidad CVE-2024-1794, denominada &#8216;Improper Neutralization of Input During Web Page Generation (&#8216;Cross-site Scripting&#8217;)&#8217;, afecta al plugin Forminator para WordPress en versiones hasta 1.29.0. Esta vulnerabilidad permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cuando un usuario acceda a dicha p\u00e1gina.<\/div>\n<p><\/p>\n<div>La vulnerabilidad de Cross-Site Scripting (XSS) almacenado se produce por una insuficiente sanitizaci\u00f3n de la entrada y el escape de salida de archivos cargados por los usuarios. Los atacantes pueden aprovechar esta vulnerabilidad para cargar archivos maliciosos, como archivos 3gpp, que contienen scripts maliciosos que se ejecutar\u00e1n en el navegador de los usuarios.<\/div>\n<div>Es fundamental mantener actualizados los plugins de WordPress y seguir buenas pr\u00e1cticas de seguridad para protegerse contra vulnerabilidades conocidas como la CVE-2024-1794 en el caso de Forminator. La prevenci\u00f3n y la concienciaci\u00f3n son clave para mantener la integridad y la seguridad de un sitio web.<\/div>\n","protected":false},"excerpt":{"rendered":"<p>La vulnerabilidad CVE-2024-1794, denominada &#8216;Improper Neutralization of Input During Web Page Generation (&#8216;Cross-site Scripting&#8217;)&#8217;, afecta al plugin Forminator para WordPress en versiones hasta 1.29.0. Esta vulnerabilidad permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cuando un usuario acceda a dicha p\u00e1gina. La vulnerabilidad de Cross-Site Scripting (XSS) almacenado se [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1105],"class_list":["post-3394","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cve-2024-1794"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.8 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Forminator &lt;= 1.29.0 - Cross-Site Scripting no Autenticado a trav\u00e9s de la Subida de Archivos - SeguridadWordPress.es<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Forminator &lt;= 1.29.0 - Cross-Site Scripting no Autenticado a trav\u00e9s de la Subida de Archivos - SeguridadWordPress.es\" \/>\n<meta property=\"og:description\" content=\"La vulnerabilidad CVE-2024-1794, denominada &#8216;Improper Neutralization of Input During Web Page Generation (&#8216;Cross-site Scripting&#8217;)&#8217;, afecta al plugin Forminator para WordPress en versiones hasta 1.29.0. Esta vulnerabilidad permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cuando un usuario acceda a dicha p\u00e1gina. La vulnerabilidad de Cross-Site Scripting (XSS) almacenado se [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/\" \/>\n<meta property=\"og:site_name\" content=\"SeguridadWordPress.es\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-30T00:45:13+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/\",\"url\":\"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/\",\"name\":\"Forminator &lt;= 1.29.0 - Cross-Site Scripting no Autenticado a trav\u00e9s de la Subida de Archivos - SeguridadWordPress.es\",\"isPartOf\":{\"@id\":\"http:\/\/127.0.0.1\/#website\"},\"datePublished\":\"2024-03-30T00:45:13+00:00\",\"dateModified\":\"2024-03-30T00:45:13+00:00\",\"author\":{\"@id\":\"\"},\"breadcrumb\":{\"@id\":\"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\/\/127.0.0.1\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Forminator &lt;= 1.29.0 &#8211; Cross-Site Scripting no Autenticado a trav\u00e9s de la Subida de Archivos\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/127.0.0.1\/#website\",\"url\":\"http:\/\/127.0.0.1\/\",\"name\":\"SeguridadWordPress.es\",\"description\":\"Recopilaci\u00f3n de vulnerabilidades WordPress.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/127.0.0.1\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Forminator &lt;= 1.29.0 - Cross-Site Scripting no Autenticado a trav\u00e9s de la Subida de Archivos - SeguridadWordPress.es","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/","og_locale":"en_US","og_type":"article","og_title":"Forminator &lt;= 1.29.0 - Cross-Site Scripting no Autenticado a trav\u00e9s de la Subida de Archivos - SeguridadWordPress.es","og_description":"La vulnerabilidad CVE-2024-1794, denominada &#8216;Improper Neutralization of Input During Web Page Generation (&#8216;Cross-site Scripting&#8217;)&#8217;, afecta al plugin Forminator para WordPress en versiones hasta 1.29.0. Esta vulnerabilidad permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cuando un usuario acceda a dicha p\u00e1gina. La vulnerabilidad de Cross-Site Scripting (XSS) almacenado se [&hellip;]","og_url":"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/","og_site_name":"SeguridadWordPress.es","article_published_time":"2024-03-30T00:45:13+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/","url":"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/","name":"Forminator &lt;= 1.29.0 - Cross-Site Scripting no Autenticado a trav\u00e9s de la Subida de Archivos - SeguridadWordPress.es","isPartOf":{"@id":"http:\/\/127.0.0.1\/#website"},"datePublished":"2024-03-30T00:45:13+00:00","dateModified":"2024-03-30T00:45:13+00:00","author":{"@id":""},"breadcrumb":{"@id":"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/127.0.0.1\/forminator-1-29-0-cross-site-scripting-no-autenticado-a-traves-de-la-subida-de-archivos\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/127.0.0.1\/"},{"@type":"ListItem","position":2,"name":"Forminator &lt;= 1.29.0 &#8211; Cross-Site Scripting no Autenticado a trav\u00e9s de la Subida de Archivos"}]},{"@type":"WebSite","@id":"http:\/\/127.0.0.1\/#website","url":"http:\/\/127.0.0.1\/","name":"SeguridadWordPress.es","description":"Recopilaci\u00f3n de vulnerabilidades WordPress.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/127.0.0.1\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}},"amp_enabled":true,"_links":{"self":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/3394"}],"collection":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/comments?post=3394"}],"version-history":[{"count":0,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/3394\/revisions"}],"wp:attachment":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/media?parent=3394"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/categories?post=3394"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/tags?post=3394"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}