CVE-2021-24874

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Score

CVSS 3.1 6.1 Medium

Status

Modified - contact@wpscan.com

Published

2022-02-14

Last modified

2024-08-03

Weaknesses

CWE-79

Affected products

• Newsletter, Smtp, Email Marketing And Subscribe (Brevo)
• Email Marketing And Subscribe Forms By Sendinblue (Unknown)
• Newsletter (Unknown)
• Smtp (Unknown)

References

• https://wpscan.com/vulnerability/28d34cc1-2294-4409-a60f-c8c441eb3f2d