What is the severity of CVE-2021-24874?

The severity of CVE-2021-24874 is medium, with a CVSS score of 6.1.

What is the CWE classification for CVE-2021-24874?

CVE-2021-24874 has a CWE classification of CWE-79, which is a category for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

How can I fix CVE-2021-24874?

To fix CVE-2021-24874, you should update the Sendinblue WordPress plugin to version 3.1.31 or later.

Vulnerability/
CVE-2021-24874

medium

6.1

CWE

14/2/2022

16/10/2024

CVE-2021-24874: Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.31 - Reflected Cross-Site Scripting

Q: What is CVE-2021-24874?

CVE-2021-24874 is a vulnerability found in the Newsletter SMTP Email marketing and Subscribe forms by Sendinblue WordPress plugin before version 3.1.31.

Q: How does CVE-2021-24874 affect the affected software?

CVE-2021-24874 affects the Sendinblue Newsletter, SMTP, Email marketing and Subscribe forms WordPress plugin before version 3.1.31.

First published: Mon Feb 14 2022(Updated: )

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Credit: contact@wpscan.com contact@wpscan.com

Affected Software	Affected Version	How to fix
Brevo	<3.1.31
Sendinblue	<3.1.31

Never miss a vulnerability like this again

Reference Links

https://wpscan.com/vulnerability/28d34cc1-2294-4409-a60f-c8c441eb3f2d

Frequently Asked Questions

What is CVE-2021-24874?
CVE-2021-24874 is a vulnerability found in the Newsletter SMTP Email marketing and Subscribe forms by Sendinblue WordPress plugin before version 3.1.31.
What is the severity of CVE-2021-24874?
The severity of CVE-2021-24874 is medium, with a CVSS score of 6.1.
How does CVE-2021-24874 affect the affected software?
CVE-2021-24874 affects the Sendinblue Newsletter, SMTP, Email marketing and Subscribe forms WordPress plugin before version 3.1.31.
What is the CWE classification for CVE-2021-24874?
CVE-2021-24874 has a CWE classification of CWE-79, which is a category for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How can I fix CVE-2021-24874?
To fix CVE-2021-24874, you should update the Sendinblue WordPress plugin to version 3.1.31 or later.

agent/type
collector/mitre-cve
source/MITRE
agent/references
agent/weakness
agent/title
agent/severity
agent/description
agent/first-publish-date
agent/event
agent/author
agent/last-modified-date
agent/source
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
agent/softwarecombine
agent/tags
collector/nvd-index
vendor/brevo
canonical/brevo
vendor/sendinblue
canonical/sendinblue

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.