2.7Düşük

CVE-2026-107775Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution Yayım: 2026-11-05 09:00 (8 gün önce)

Açıklama

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.

Zayıflık türü (CWE): CWE-863

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
—	Dokan: AI Powered WooCommerce Multivendor Marketplace Solution	< 5.3.3

Kaynaklar ve yamalar

https://wpscan.com/vulnerability/7a1d3c6c-fb78-41cc-85bb-4d86ac1ca3df/ exploitvdb-entrytechnical-description

CVSS puanı

2.7Düşük

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yüksek
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yok
Bütünlük: Düşük
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Tüm puanlar (2)

CISA-ADP	CVSS 3.1	2.7Düşük
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	2.7Düşük

EPSS (30 günde istismar olasılığı)

0.17%

tüm CVE'lerin %6'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2026-10-08
Yayımlandı2026-11-05 09:00
IP-DB'ye ulaştı2026-11-05 10:03
Son güncelleme2026-11-06 16:17

Numarayı veren (CNA): WPScan
NVD durumu: Deferred

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

7.1Yüksek

CVE-2026-119517 4 saat önce

WordPress Catna – Woo Name Your Price and Offers plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

VillaTheme Catna – Woo Name Your Price and Offers

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price an…

9.3Kritik

CVE-2026-124415 4 saat önce

WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Alejandro Alex Reservations

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

5.3Orta

CVE-2026-125432 4 saat önce

WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability

RelyWP reCAPTCHA for WooCommerce

Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.

8.5Yüksek

CVE-2026-124265 4 saat önce

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

Tribulant Software Newsletters

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

7.5Yüksek

CVE-2026-124267 4 saat önce

WordPress Gmail SMTP plugin <= 1.2.3.23 - Broken Access Control vulnerability

Noor Alam Gmail SMTP

Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.

7.1Yüksek

CVE-2026-124410 4 saat önce

WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua wplingua allows Stored XSS.This issue affects Translat…