PT-2023-11377 · WordPress · Email Templates

Jerome Bruandet · CVE-2019-25150 · Publicado 2023-06-07 · Atualizado 2023-06-12

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Email Templates plugin for WordPress versions up to and including 1.3

Description The issue allows attackers to perform HTML Injection, enabling them to present phishing forms or conduct cross-site request forgery attacks against site administrators.

Recommendations For Email Templates plugin for WordPress versions up to and including 1.3, update to a version higher than 1.3 to resolve the issue.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2019-25150

Produtos afetados

Email Templates

Referências · 5

• 🔥 https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection · Exploit
• https://osv.dev/vulnerability/CVE-2019-25150 · Aviso do Fabricante
• https://wordpress.org/plugins/email-templates/#developers · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/f5c449f1-4715-4033-b0a3-6a8ca968aabc?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25150 · Nota de Segurança