CVE-2019-25145 - Contact Form & SMTP Plugin by PirateForms <= 2.5.1

Back Back to CVE browser

HIGH

Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection

Published Jun 7, 2023

7.2

HIGH

CVSS 3.1

EPSS 0.66%

Description

The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML in emails that could be used to phish unsuspecting victims.

Affected products

Vendor Smub Product Contact Form & SMTP Plugin for WordPress by PirateForms Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <2.5.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Smub

Contact Form & SMTP Plugin for WordPress by PirateForms

unaffected

Version	Status	Constraints
-	affected	<2.5.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://blog.nintechnet.com/html-injection-vulnerability-in-wordpress-pirate-forms-plugin/
Exploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11579
Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/9e34c3f6-cc84-4e45-9948-6f7fd5cba8cd?source=cve
Broken LinkThird Party Advisory

Link	Providers	Tags
https://blog.nintechnet.com/html-injection-vulnerability-in-wordpress-pirate-forms-plugin/		Exploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-11579		Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/9e34c3f6-cc84-4e45-9948-6f7fd5cba8cd?source=cve		Broken LinkThird Party Advisory