CVE-2021-24874: Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.31 - Reflected Cross-Site Scripting
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24874?
CVE-2021-24874 is a vulnerability found in the Newsletter SMTP Email marketing and Subscribe forms by Sendinblue WordPress plugin before version 3.1.31.
What is the severity of CVE-2021-24874?
The severity of CVE-2021-24874 is medium, with a CVSS score of 6.1.
How does CVE-2021-24874 affect the affected software?
CVE-2021-24874 affects the Sendinblue Newsletter, SMTP, Email marketing and Subscribe forms WordPress plugin before version 3.1.31.
What is the CWE classification for CVE-2021-24874?
CVE-2021-24874 has a CWE classification of CWE-79, which is a category for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How can I fix CVE-2021-24874?
To fix CVE-2021-24874, you should update the Sendinblue WordPress plugin to version 3.1.31 or later.