CVE-2021-24923CWE-79

Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS

published January 24, 2022

CVSS
—
EPSS
1%
Percentile
56.5
In the wild
Unconfirmed
What it is

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00810 · 56.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-01-24T08:00Z
EPSS history
Timeline
  • 24 JAN 08:00Z
    Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS
    cvelistv5