CVE-2021-24528CWE-79

FluentSMTP < 2.0.1 - Authenticated Stored XSS

published August 30, 2021

CVSS
—
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00624 · 49.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-08-30T14:11Z
EPSS history
Timeline
  • 30 AUG 14:11Z
    FluentSMTP < 2.0.1 - Authenticated Stored XSS
    cvelistv5