CVE-2019-25145
Last modified
CVE-2019-25145 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML in emails that could be used to phish unsuspecting victims.. EPSS estimates a 0.66% chance of exploitation in the next 30 days.
Description
The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML in emails that could be used to phish unsuspecting victims.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wpforms | Contact Form | <= 2.5.1 |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9e34c3f6-cc84-4e45-9948-6f7fd5cba8cd?source=cveBroken Link, Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9e34c3f6-cc84-4e45-9948-6f7fd5cba8cd?source=cveBroken Link, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-25145?
How severe is CVE-2019-25145?
How do I fix CVE-2019-25145?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-25139The Coming Soon Page & Maintenance Mode plugin for WordPress…5.3
- CVE-2019-25140The WordPress Coming Soon Page & Maintenance Mode plugin for…6.1
- CVE-2019-25141The Easy WP SMTP plugin for WordPress is vulnerable to autho…9.8
- CVE-2019-25142The Mesmerize & Materialis themes for WordPress are vulnerab…8.8
- CVE-2019-25143The GDPR Cookie Compliance plugin for WordPress is vulnerabl…4.3
- CVE-2019-25144The WP HTML Mail plugin for WordPress is vulnerable to HTML …6.1
- CVE-2019-25146The DELUCKS SEO plugin for WordPress is vulnerable to Stored…6.1
- CVE-2019-25147The Pretty Links plugin for WordPress is vulnerable to Store…6.1
- CVE-2019-25148The WP HTML Mail plugin for WordPress is vulnerable to HTML …6.1
- CVE-2019-25149The Gallery Images Ape plugin for WordPress is vulnerable to…4.3
- CVE-2019-25150The Email Templates plugin for WordPress is vulnerable to HT…8.8
- CVE-2019-25151The Funnel Builder plugin for WordPress is vulnerable to aut…4.3
Are you affected by CVE-2019-25145?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST