The WP Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
History

Fri, 27 Sep 2024 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Boopathirajan
Boopathirajan wp Test Email
CPEs cpe:2.3:a:boopathirajan:wp_test_email:*:*:*:*:*:wordpress:*:*
Vendors & Products Boopathirajan
Boopathirajan wp Test Email

Fri, 13 Sep 2024 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 13 Sep 2024 07:00:00 +0000

Type Values Removed Values Added
Description The WP Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title WP Test Email <= 1.1.7 - Reflected Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-09-13T06:47:28.190Z

Updated: 2024-09-13T13:42:04.602Z

Reserved: 2024-09-10T16:46:50.923Z

Link: CVE-2024-8664

cve-icon Vulnrichment

Updated: 2024-09-13T13:42:00.461Z

cve-icon NVD

Status : Analyzed

Published: 2024-09-13T07:15:07.487

Modified: 2024-09-27T13:48:58.270

Link: CVE-2024-8664

cve-icon Redhat

No data.