Lucene search

[email protected]NVD:CVE-2019-25145

HistoryJun 07, 2023 - 2:15 a.m.

CVE-2019-25145

2023-06-0702:15:10

CWE-79

[email protected]

web.nvd.nist.gov

contact form

smtp plugin

pirateforms

wordpress

html injection

input sanitization

output escaping

unauthenticated attackers

phishing

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

47.3%

JSON

The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML in emails that could be used to phish unsuspecting victims.

Affected configurations

NVD

Node

wpformscontact_formRange≤2.5.1wordpress

References

blog.nintechnet.com/html-injection-vulnerability-in-wordpress-pirate-forms-plugin/

www.wordfence.com/threat-intel/vulnerabilities/id/9e34c3f6-cc84-4e45-9948-6f7fd5cba8cd?source=cve

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

47.3%

JSON

Related for NVD:CVE-2019-25145

cve1 prion1 cvelist1