PT-2023-11371 · WordPress · Wp Html Mail

Jerome Bruandet · Publicado 2023-06-07 · Atualizado 2023-06-13 · CVE-2019-25144

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP HTML Mail plugin for WordPress versions up to, and including, 2.2.10

Description The issue arises from insufficient input sanitization, allowing unauthenticated attackers to inject arbitrary HTML in pages. This can happen if an attacker successfully tricks an administrator into performing a specific action, such as clicking on a link.

Recommendations For versions up to, and including, 2.2.10, update to a version higher than 2.2.10 to resolve the issue. As a temporary workaround, consider restricting access to areas where HTML injection could be executed until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25144

Produtos afetados

Wp Html Mail

Referências · 6

• 🔥 https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection · Exploit
• https://t.me/cibsecurity/65025 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-25144 · Nota de Segurança
• https://t.me/cvenotify/51935 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-25144 · Aviso do Fabricante
• https://wordfence.com/threat-intel/vulnerabilities/id/946ba166-3309-4e47-8b6b-d3f017bbfcc8?source=cve · Nota