{“error”:0,”message”:null,”data”:{“name”:”MailPoet – Newsletters, Email Marketing, and Automation”,”plugin”:”mailpoet”,”link”:”https:\/\/wordpress.org\/plugins\/mailpoet\/”,”latest”:”1753189860″,”closed”:0,”vulnerability”:[{“uuid”:”943d21d215d147a5b7f226908d4e4bfab184a06e6e943ced06d636d53b555422″,”name”:”MailPoet – Newsletters, Email Marketing, and Automation [mailpoet] < 3.23.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.23.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2019-11843","name":"CVE-2019-11843","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2019-11843","description":"[en] The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).","date":"2020-06-02"},{"id":"98f0fa04250d17dd8ad7a0046fb40cf769019915","name":"MailPoet \u2013 emails and newsletters in WordPress <= 3.23.1 – Reflected Cross-Site Scripting via URL parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailpoet\/mailpoet-emails-and-newsletters-in-wordpress-3231-reflected-cross-site-scripting-via-url-parameter","description":"The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).","date":"2019-04-16"},{"id":"dfa5d10b-0b4c-41fa-b2ab-21f31dfbd5fe","name":"MailPoet < 3.23.2 – Reflected Cross-Site Scripting Issue","link":"https:\/\/wpscan.com\/vulnerability\/dfa5d10b-0b4c-41fa-b2ab-21f31dfbd5fe","description":"The MailPoet – emails and newsletters in WordPress WordPress plugin was affected by a Reflected Cross-Site Scripting Issue security vulnerability.","date":null}],"impact":{"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"1e4d38ec828fc0428feafb7884052019c60da17e35365e8b061c387373b8f99c","name":"MailPoet – Newsletters, Email Marketing, and Automation [mailpoet] < 5.3.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.3.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-10103","name":"CVE-2024-10103","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-10103","description":"[en] In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor","date":"2024-11-19"},{"id":"9e7deec833da38ba26ef1fd0a145d64ce5b8231a","name":"MailPoet <= 5.3.1 – Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mailpoet\/mailpoet-531-authenticated-administrator-stored-cross-site-scripting","description":"The MailPoet \u2013 Newsletters, Email Marketing, and Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-10-29"},{"id":"276dad14fa8de4670e334d4a3cb7c00bfff8cea4","name":"WordPress MailPoet Plugin < 5.3.2 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailpoet\/vulnerability\/wordpress-mailpoet-plugin-5-3-2-admin-stored-xss-vulnerability","description":"
WordPress MailPoet Plugin < 5.3.2 is vulnerable to Cross Site Scripting (XSS)
Software: MailPoet
Link: https:\/\/wordpress.org\/plugins\/mailpoet\/#developers
Affected Version < 5.3.2
Fixed in version 5.3.2 “,”date”:”2024-11-19″}],”impact”:{“cwe”:[{“cwe”:”CWE-79″,”name”:”Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)”,”description”:”The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.”}]}},{“uuid”:”f1b24aa4cfdedb38db5db9f87827adee3b93514d1f5cf56ab5405fde7a357e4a”,”name”:”MailPoet – Newsletters, Email Marketing, and Automation [mailpoet] < 5.5.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.5.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-12743","name":"CVE-2024-12743","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-12743","description":"[en] The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"2025-05-15"},{"id":"386a8c282099308bba8e5bad029929902e91cee8","name":"WordPress MailPoet Plugin < 5.5.2 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mailpoet\/vulnerability\/wordpress-mailpoet-plugin-5-5-2-admin-stored-xss-vulnerability","description":"
WordPress MailPoet Plugin < 5.5.2 is vulnerable to Cross Site Scripting (XSS)
Software: MailPoet
Fixed in version 5.5.2
Affected Version < 5.5.2
CVE: CVE-2024-12743″,”date”:”2025-05-09″},{“id”:”EUVD-2025-15320″,”name”:”EUVD-2025-15320″,”link”:”https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-15320″,”description”:”The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).”,”date”:”2025-05-15″}],”impact”:{“cwe”:[{“cwe”:”CWE-79″,”name”:”Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)”,”description”:”The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.”}]}}]},”updated”:”1750132302″}