Reflected Cross-Site Scripting Vulnerability in WP Test Email Plugin

CVE-2024-8664

What is CVE-2024-8664?

The WP Test Email plugin for WordPress is susceptible to a Reflected Cross-Site Scripting flaw, stemming from the improper use of the add_query_arg function without adequate URL escaping in all versions up to and including 1.1.7. This vulnerability creates an opportunity for malicious, unauthenticated attackers to inject arbitrary scripts into the webpages. Such scripts may execute within users' browsers when they are tricked into clicking a specially crafted link, potentially compromising sensitive information and user interaction on affected sites.

References