IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
5.3Orta

CVE-2026-107774Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution Yayım: (8 gün önce)

Açıklama

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.

Zayıflık türü (CWE): CWE-290

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
— Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 5.3.3

Kaynaklar ve yamalar

Aynı üründe son açıklar — WordPress plugins & themes

Puansız
CVE-2026-125711

Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name

Widgets for Google Reviews; WP Tripadvisor Review Widgets; Widgets for Booking.com Reviews; Widgets for Reviews & Recommendations

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets …