CVE-2021-24528: FluentSMTP < 2.0.1 - Authenticated Stored XSS
The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24528?
CVE-2021-24528 is classified as a medium severity vulnerability due to its potential for stored cross-site scripting (XSS).
How do I fix CVE-2021-24528?
To fix CVE-2021-24528, update the FluentSMTP plugin to version 2.0.1 or later, which addresses the security issues.
What kind of vulnerability is CVE-2021-24528?
CVE-2021-24528 is a stored cross-site scripting (XSS) vulnerability resulting from improper sanitization of plugin settings.
Which versions of FluentSMTP are affected by CVE-2021-24528?
FluentSMTP versions prior to 2.0.1 are affected by CVE-2021-24528.
What are the potential impacts of CVE-2021-24528?
CVE-2021-24528 can lead to unauthorized script execution in the context of the user’s browser, compromising site security.