CVE-2021-24874
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.31 - Reflected Cross-Site Scripting
MEDIUM 6.1EPSS 0.8%
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Affected
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 0.80% chance of exploitation in the next 30 days, 56th percentile
- Published
- 2022-02-14
- Updated
- 2024-08-03