What the vulnerability does
01Description
A vulnerability, which was classified as problematic, has been found in atwellpub Resend Welcome Email Plugin 1.0.1 on WordPress. This issue affects the function send_welcome_email_url of the file resend-welcome-email.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is b14c1f66d307783f0ae74f88088a85999107695c. It is recommended to upgrade the affected component. The identifier VDB-220637 was assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Resend Welcome Email Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in version 1.0.1. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction to trigger. This allows attackers to steal session cookies, redirect users, or deface site content.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they view affected pages.
Potential impact on your site
04Site Impact
Authenticated users can inject code that compromises other visitors' sessions or spreads malware across your site.
Conditions required to exploit
05Prerequisites
Attacker must be logged in with low-level user privileges and trick a site visitor into viewing a page containing the injected script.
Key dates
06Disclosure timeline
February 12, 2023
CVE published
August 6, 2024
Record updated
