IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
4.3Orta

CVE-2026-107343Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing

Kali Forms — Contact Form & Drag-and-Drop Builder Yayım: (3 gün önce)

Açıklama

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.

Zayıflık türü (CWE): CWE-862

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
— Kali Forms — Contact Form & Drag-and-Drop Builder < 2.4.30

Kaynaklar ve yamalar

Aynı üründe son açıklar — WordPress plugins & themes

7.2Yüksek
CVE-2026-97397

Remove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer

easywpstuff Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance

The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insu…