CVEvulnerability
CVE-2019-25150
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-06-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-74
Description
The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3. This makes it possible for attackers to present phishing forms or conduct cross-site request forgery attacks against site administrators.
Affected configurations
• wpexperts email templates (< 1.3.1)
Related
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection/ Exploit
- https://wordpress.org/plugins/email-templates/#developers Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f5c449f1-4715-4033-b0a3-6a8ca968aabc?source=cve Third Party Advisory
- https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection/ Exploit
- https://wordpress.org/plugins/email-templates/#developers Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f5c449f1-4715-4033-b0a3-6a8ca968aabc?source=cve Third Party Advisory