Now officially on WordPress.org

CVE Database / CVE-2019-11843

CVE · Medium

CVE-2019-11843 — MailPoet – Newsletters, Email Marketing, and Automation [mailpoet] < 3.23.2

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2019-11843 MailPoet – Newsletters, Email Marketing, and Automation [mailpoet] < 3.23.2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.1 < 3.23.2 3.23.2 2019-04-16 —

CVE-2019-11843

MailPoet versions prior to 3.23.2 contain a reflected cross-site scripting vulnerability where attackers can inject malicious scripts or HTML code by appending specially crafted parameters to the plugin's URLs. An attacker can exploit this flaw to execute arbitrary JavaScript in the context of a user's browser session or inject HTML content without authorization. This issue was resolved in version 3.23.2 and later releases.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings