Reflected Cross-Site Scripting Vulnerability in WordPress Email Newsletter Plugin
CVE-2024-13098

Currently unrated

Key Information:

Vendor
WordPress
Status
WordPress Email Newsletter
Vendor
CVE Published:
1 February 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The WordPress Email Newsletter plugin, up to version 1.1, contains a vulnerability that does not properly sanitize and escape user inputs before rendering on pages. This oversight allows attackers to execute reflected cross-site scripting attacks, which could potentially target users with high privileges, including administrators. By exploiting this weakness, an attacker could inject malicious scripts into the web page viewed by affected users, leading to unauthorized actions and data exposure.

Affected Version(s)

WordPress Email Newsletter 0 <= 1.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-13098 - Proof of Concept

References

https://wpscan.com/vulnerability/eac71f70-993e-4353-8550-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hassan Khan Yusufzai - Splint3r7
WPScan
.