CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3. This makes it possible for attackers to present phishing forms or conduct cross-site request forgery attacks against site administrators.
Explanation of Vulnerability in Simple Terms
The Email Templates Customizer and Designer plugin for WordPress and WooCommerce versions 1.3 and earlier contains an improper input validation flaw that allows attackers to inject and execute malicious code. An attacker can craft a malicious link or file that, when clicked or opened by a site administrator, executes arbitrary code with full site privileges. This affects all installations running the vulnerable versions.
What an attacker can do
Execute arbitrary code on the WordPress site by tricking an admin into clicking a malicious link.
Potential impact on your site
Attackers can take full control of your WordPress site, steal data, modify content, or install backdoors.
Conditions required to exploit
An administrator must click a link or visit a page controlled by the attacker.
Key dates
External resources
Related vulnerabilities
