CVE-2021-47870: GetSimple CMS My SMTP Contact Plugin 1.1.2 - Stored XSS

Published Jan 21, 2026

Updated

GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin attempts to sanitize user input using htmlspecialchars(), but this can be bypassed by passing dangerous characters as escaped hex bytes. This allows attackers to inject arbitrary client-side code that executes in the administrator's browser when visiting a malicious page.

Affected Software

2 affected components

GetSimple GetSimple CMS My SMTP Contact Plugin

Get-simple Getsimplecms=1.1.2

Event History

Jan 21, 2026

CVE Published

via MITRE·05:32 PM

Data Sourced

via MITRE·05:32 PM

DescriptionWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeaknessAffected Software

Jul 2, 58343

Event

via NVD·04:55 PM

Frequently Asked Questions

What is the severity of CVE-2021-47870?

CVE-2021-47870 has a medium severity level due to the potential for stored cross-site scripting attacks.

How do I fix CVE-2021-47870?

To fix CVE-2021-47870, update to the latest version of the GetSimple CMS My SMTP Contact Plugin that addresses this XSS vulnerability.

What software is affected by CVE-2021-47870?

CVE-2021-47870 affects the GetSimple CMS My SMTP Contact Plugin version 1.1.2.

What type of vulnerability is CVE-2021-47870?

CVE-2021-47870 is categorized as a Stored Cross-Site Scripting (XSS) vulnerability.

Can CVE-2021-47870 lead to data compromise?

Yes, CVE-2021-47870 can lead to data compromise by allowing attackers to execute malicious scripts within a user's session.