Email Templates <= 1.4.2 - Cross-Site Request Forgery via send_test_email
medium
The Email Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the send_test_email function. This makes it possible for unauthenticated attackers to send test emails via a forged request granted they c...
- CVSS:
- 4.3
- Affected:
- up to 1.4.2
- Fixed in:
- 1.4.3
- Disclosed:
- Nov 3, 2023
CVE-2022-47181 on NVD →
Email Templates <= 1.3 - HTML Injection
high
The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3. This makes it possible for attackers to present phishing forms or conduct cross-site request forgery attacks against site administrators.
- CVSS:
- 8.8
- Affected:
- up to 1.3
- Fixed in:
- 1.3.1
- Disclosed:
- Oct 25, 2019
CVE-2019-25150 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database