CVE-2019-25145: Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection
The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML in emails that could be used to phish unsuspecting victims.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this WordPress plugin?
The vulnerability ID for this WordPress plugin is CVE-2019-25145.
What is the severity of CVE-2019-25145?
The severity of CVE-2019-25145 is high with a CVSS score of 6.1.
What is the affected software by CVE-2019-25145?
The affected software is the Contact Form & SMTP Plugin by PirateForms plugin for WordPress versions up to, and including, 2.5.1.
What is the impact of CVE-2019-25145?
CVE-2019-25145 allows for HTML injection, which can be used by an unauthenticated attacker to inject malicious HTML code into the affected web pages, potentially leading to further attacks or unauthorized access.
How can I fix CVE-2019-25145?
To fix CVE-2019-25145, it is recommended to update the Contact Form & SMTP Plugin by PirateForms plugin for WordPress to a version above 2.5.1, which includes the necessary input sanitization and output escaping to mitigate the HTML injection vulnerability.