PT-2023-11377 · WordPress · Email Templates

Jerome Bruandet · Published 2023-06-07 · Updated 2023-06-12 · CVE-2019-25150

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Email Templates plugin for WordPress versions up to and including 1.3

Description The issue allows attackers to perform HTML Injection, enabling them to present phishing forms or conduct cross-site request forgery attacks against site administrators.

Recommendations For Email Templates plugin for WordPress versions up to and including 1.3, update to a version higher than 1.3 to resolve the issue.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2019-25150

Affected Products

Email Templates

References · 5

• 🔥 https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection · Exploit
• https://osv.dev/vulnerability/CVE-2019-25150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25150 · Security Note
• https://wordpress.org/plugins/email-templates/#developers · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f5c449f1-4715-4033-b0a3-6a8ca968aabc?source=cve · Note