CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail yeemail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through <= 2.1.4.
Explanation of Vulnerability in Simple Terms
YeeMail, a WordPress email template builder plugin, contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.1.4. An authenticated user with low privileges can inject malicious scripts into email templates. When another user views or interacts with the affected template, the script executes in their browser, potentially compromising their account or stealing sensitive data.
What an attacker can do
Inject malicious scripts into email templates that execute when other users view them.
Potential impact on your site
Compromised user accounts, stolen session tokens, or malware distribution through email templates visible to site administrators and users.
Conditions required to exploit
Attacker must have a WordPress account with low-level permissions and trick a user into viewing the malicious template.
Key dates
External resources
Related vulnerabilities
