1. Home
  2. CVE Database
  3. CVE-2021-24528
MEDIUM · 5.4

CVE-2021-24528

The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMT...

Vulnerability Description

The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
WpmanageninjaFluentsmtp< 2.0.1

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2021-24528?

CVE-2021-24528 is a vulnerability with a CVSS score of 5.4 (MEDIUM). The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMT...

How severe is CVE-2021-24528?

CVE-2021-24528 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-24528?

Check the references section above for vendor advisories and patch information. Affected products include: Wpmanageninja Fluentsmtp.