CVE-2021-47870

GetSimple CMS My SMTP Contact Plugin 1.1.2 - Stored XSS

GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin attempts to sanitize user input using htmlspecialchars(), but this can be bypassed by passing dangerous characters as escaped hex bytes. This allows attackers to inject arbitrary client-side code that executes in the administrator's browser when visiting a malicious page.

Affected

GetSimple CMS · My SMTP Contact Plugin

CVSS v4.0 VULNCHECK

4.8 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.28% chance of exploitation in the next 30 days, 19th percentile

Published

2026-01-21

Updated

2026-05-12

Proof-of-concept exploits (2)

• boku7/gsSMTP-Csrf2Xss2RCE/14★ · 2023-03-08
• https://www.exploit-db.com/exploits/49798

Security advisories

• boku7/gsSMTP-Csrf2Xss2RCE
• https://www.vulncheck.com/advisories/getsimple-cms-my-smtp-contact-plugin-stored-xss
• http://get-simple.info
• GetSimpleCMS/GetSimpleCMS

References

• CVE Record
• NVD entry

Related

• CVE-2020-23839
• CVE-2021-47778
• CVE-2021-47860