Now officially on WordPress.org

CVE Database / CVE-2024-35668

CVE · Medium

CVE-2024-35668 — Brevo – Email, SMS, Web Push, Chat, and more. [mailin] < 3.1.78

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-35668 Brevo – Email, SMS, Web Push, Chat, and more. [mailin] < 3.1.78 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.1 < 3.1.78 3.1.78 2024-06-03 —

CVE-2024-35668

The Brevo plugin for WordPress, which handles newsletter management, SMTP configuration, email marketing, and subscription forms, contains a reflected cross-site scripting vulnerability affecting versions up to and including 3.1.77. Attackers without authentication can exploit improper sanitization and escaping to inject malicious scripts into web pages, which execute when users are tricked into clicking a crafted link. The vulnerability was fixed in version 3.1.78.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings