CVE-2026-105322

MediumCVSS 5.3/10Last modified Oct 7, 2026

Description

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-472

Affected software

No affected versions have been published.

Timeline

Published
Oct 7, 2026
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1053249.2An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on CVE-2026-1053262.5An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requestCVE-2026-1053296.3A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/CVE-2026-105335.0A flaw was found in OpenShift Container Platform. Completed pods with restartPolicy: Never do not count toward ResourceQuota pod limits, andCVE-2026-1053315.2Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agCVE-2026-105349.8IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser.CVE-2026-105357.8IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.CVE-2026-105369.8A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDSCVE-2026-105388.0Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in thCVE-2026-1053827.3A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function CVE-2026-1053837.3A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an uCVE-2026-1053847.3A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function
CVE-2026-105322: Medium severity, CVSS 5.3 | Vulnix