Stored Cross-Site Scripting in MailerLite Signup Forms Plugin for WordPress
CVE-2024-1386

6.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Mailerlite – Signup Forms (official)
Vendor
CVE Published:
2 May 2024

Summary

The MailerLite Signup Forms plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks due to inadequate sanitization of user input and lack of proper output encoding on shortcode attributes. This vulnerability allows authenticated users with contributor-level permissions or higher to insert malicious scripts into web pages. When a victim accesses a page with the injected script, it executes in their browser, potentially compromising user data and session integrity.

Affected Version(s)

MailerLite – Signup forms (official) 1.5.0 <= 1.7.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/official-maile...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Richard Telleng
.