PT-2021-16050 · WordPress · Fluentsmtp

Yoshiken · Published 2021-08-30 · Updated 2021-09-02 · CVE-2021-24528

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FluentSMTP WordPress plugin versions prior to 2.0.1

Description The issue arises from the plugin's failure to sanitize parameters before storing settings in the database and its failure to escape values before outputting them when viewing SMTP settings. This leads to a stored cross-site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings.

Recommendations For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24528

Affected Products

Fluentsmtp

References · 4

• 🔥 https://wpscan.com/vulnerability/8b8d316b-96b2-4cdc-9da5-c9ea6108a85b · Exploit
• https://osv.dev/vulnerability/CVE-2021-24528 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24528 · Security Note
• https://t.me/cibsecurity/28003 · Telegram Post